Splunk Search

How to extract many fields with a single regular expression ?

Allampally
Path Finder

Hi,

I have a sample log file as shown in the attached screenshot.
I have many such tags in the log file. I want to extract all time delay tags as a separate filed. It will be a tedious task to write separate regular expression for each tag. Is there any way to extract all the tags with single regular expression ?
How can i achieve this ?

alt text

Tags (1)
0 Karma

niketn
Legend

@Allampally, If your raw data is xml you can use KV_MODE=xml in your props.conf to extract all xml nodes at search time field discovery.

Alternatively you can can use spath command with your xml data, which should extract all xml nodes similar to above approach.

<yourCurrentSearch>
| spath

If you need Regex based extraction (Search Time using SPL or Transform) you can refer to the following answer for generic Regular Expression for extracting KV Pair from XML: https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Shan
Builder

@Allampally
Instead of screenshot.. Can you kindly post log sample here.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...