Dashboards & Visualizations

How to use spath to strip HTML from Page Response?

SplunkTrust
SplunkTrust

Hi All,

I am having trouble stripping HTML from a response from sending eReceipts to customers via dashboard. Here is the HTML I am trying to strip to only show the message in a pretty human-readable format:

<BODY bgcolor=#dddddd> <TABLE bgcolor=#dddddd border=1> <TR> <TD valign="top"><B>message</B></TD> <TD>Ereceipt successfully sent out</TD> </TR> </TABLE> </BODY> 

For testing, I used this search to strip the initial HTML of the response in the search app (it works):

| stats count
| eval ctgResponse=HTML ABOVE
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"

However, when sending an eReceipt to a customer, the dashboard still displays the HTML formatted response.

Here is the search behind the dashboard including the spath command (cgereceiptsresubmit is a custom command):

    <title>Your Re-Submit Results:</title>
                <searchString> <![CDATA[ 
|stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"
| table resubmit_url,ctg_response, resubmit_error
| rename resubmit_url as "Re-Submit URL", ctg_response as "CTG Response", resubmit_error as "Re-Submit Error Message"
]]>
</searchString>

Any insight on a why this might not be working would be greatly appreciated..

Thanks in advance!

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Try this as your search

Answer Updated:

 |stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| rex field=responseMessage "\<TD\>(?<responseMessage>[^\<]+)"
| table resubmit_url,responseMessage, resubmit_error
| rename resubmit_url as "Re-Submit URL", responseMessage as "CTG Response", resubmit_error as "Re-Submit Error Message"
0 Karma

SplunkTrust
SplunkTrust

This didn't quite work. What I did was send a test email to my own email account, and the dashboard still sent the eReceipt, however the table is not displaying any message. Please view the screenshot:

http://screencast.com/t/CehgFRg7tr

Thanks a lot for your efforts! Please let me know if there is anything else you need from me to resolve this.

0 Karma

SplunkTrust
SplunkTrust

What is the output you're expecting after stipping html content.

0 Karma

SplunkTrust
SplunkTrust

It will just be "Ereceipt successfully sent out". Please view this screen shot:

http://screencast.com/t/vXfMwsQmgM

0 Karma

SplunkTrust
SplunkTrust

Try this instead of spath command

| rex field=ctgResponse "\<TD\>(?<ctgResponse>[^\<]+)"
0 Karma

SplunkTrust
SplunkTrust

Thanks, but I am still getting the same result using ...| rex field=ctgResponse "(?[^<]+)"
...Not 100% sure what the issue is.

0 Karma