Archive
Highlighted

Help with regex in transforms

Champion

Hi,

I'm hoping that someone can help me with a regex.

Here's the source data:

<OTHERFIELD>some values</OTHERFIELD><COMPID>string1 node 1</COMPID><MOREOTHERFIELDS>more values</MOREOTHERFIELDS>

I need to extract everything between the COMPID brackets. I have the following, but it's grabbing the extra bracket at the end.

REGEX = \<COMPID\>(?<dvcTEST>\w*\s)

I've tried regex101 site, but wasn't able to get it right.

0 Karma
Highlighted

Re: Help with regex in transforms

Splunk Employee
Splunk Employee

Does this do the trick?

(?[\w\s]+)<\/COMPID>

0 Karma
Highlighted

Re: Help with regex in transforms

Champion

This is in transforms.conf, so where would the field get defined? I tried that, it errors out when restarting the search-head:

REGEX = \<COMPID\>(?[\w\s]+)<\/COMPID>
0 Karma
Highlighted

Re: Help with regex in transforms

Builder

Hi @a212830 ,
I would do this as a one-liner in props.conf:

EXTRACT-compid = \<COMPID\>(?<dvcTEST>[^\<]+)\<\/COMPID\>

But if you REALLY want to do it in props.conf & transforms.conf:
props.conf

REPORT-extractcompid = extractcompid

transforms.conf

[extract_compid]
REGEX = &lt;COMPID&gt;(?<dvcTEST>[^&lt;]+)&lt;\/COMPID&gt;
FORMAT = dvcTEST::$1

View solution in original post

Highlighted

Re: Help with regex in transforms

Champion

Thanks. I like that better. What if I just wanted the first word between the brackets? I have similiar ones where only the first word is needed.

0 Karma
Highlighted

Re: Help with regex in transforms

Builder

Then you would use a regex match for any non-whitespace character. As an example:
Instead of [^\<]+
Use \S+

0 Karma
Highlighted

Re: Help with regex in transforms

Champion

Tried this, but it didn't work:

EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+)\<\/COMPID\>

I'm trying to get the first word between the COMPID brackets.

0 Karma
Highlighted

Re: Help with regex in transforms

New Member

add .*? after your named group or remove <\/COMPID>

0 Karma
Highlighted

Re: Help with regex in transforms

Champion

So, this? EXTRACT-testcompid = \<COMPID\>(?<testdvc>.*?)\<\/COMPID\>

I tried it in regex101, and it didn't get anything.

0 Karma
Highlighted

Re: Help with regex in transforms

Champion

Elimnated the COMPID, and it worked. Thanks everyone! Much appreciated.

0 Karma