Splunk Search

Help with regex in transforms

a212830
Champion

Hi,

I'm hoping that someone can help me with a regex.

Here's the source data:

<OTHERFIELD>some values</OTHERFIELD><COMPID>string1 node 1</COMPID><MOREOTHERFIELDS>more values</MOREOTHERFIELDS>

I need to extract everything between the COMPID brackets. I have the following, but it's grabbing the extra bracket at the end.

REGEX = \<COMPID\>(?<dvcTEST>\w*\s)

I've tried regex101 site, but wasn't able to get it right.

0 Karma
1 Solution

jnudell_2
Builder

Hi @a212830 ,
I would do this as a one-liner in props.conf:

EXTRACT-compid = \<COMPID\>(?<dvcTEST>[^\<]+)\<\/COMPID\>

But if you REALLY want to do it in props.conf & transforms.conf:
props.conf

REPORT-extract_compid = extract_compid

transforms.conf

[extract_compid]
REGEX = &lt;COMPID&gt;(?<dvcTEST>[^&lt;]+)&lt;\/COMPID&gt;
FORMAT = dvcTEST::$1

View solution in original post

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...