Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to use spath to strip HTML from Page Response?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to use spath to strip HTML from Page Response?
Hi All,
I am having trouble stripping HTML from a response from sending eReceipts to customers via dashboard. Here is the HTML I am trying to strip to only show the message in a pretty human-readable format:
<BODY bgcolor=#dddddd> <TABLE bgcolor=#dddddd border=1> <TR> <TD valign="top"><B>message</B></TD> <TD>Ereceipt successfully sent out</TD> </TR> </TABLE> </BODY>
For testing, I used this search to strip the initial HTML of the response in the search app (it works):
| stats count
| eval ctgResponse=HTML ABOVE
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"
However, when sending an eReceipt to a customer, the dashboard still displays the HTML formatted response.
Here is the search behind the dashboard including the spath command (cgereceiptsresubmit is a custom command):
<title>Your Re-Submit Results:</title>
<searchString> <![CDATA[
|stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"
| table resubmit_url,ctg_response, resubmit_error
| rename resubmit_url as "Re-Submit URL", ctg_response as "CTG Response", resubmit_error as "Re-Submit Error Message"
]]>
</searchString>
Any insight on a why this might not be working would be greatly appreciated..
Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this as your search
Answer Updated:
|stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| rex field=responseMessage "\<TD\>(?<responseMessage>[^\<]+)"
| table resubmit_url,responseMessage, resubmit_error
| rename resubmit_url as "Re-Submit URL", responseMessage as "CTG Response", resubmit_error as "Re-Submit Error Message"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This didn't quite work. What I did was send a test email to my own email account, and the dashboard still sent the eReceipt, however the table is not displaying any message. Please view the screenshot:
http://screencast.com/t/CehgFRg7tr
Thanks a lot for your efforts! Please let me know if there is anything else you need from me to resolve this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the output you're expecting after stipping html content.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It will just be "Ereceipt successfully sent out". Please view this screen shot:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this instead of spath command
| rex field=ctgResponse "\<TD\>(?<ctgResponse>[^\<]+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, but I am still getting the same result using ...| rex field=ctgResponse "(?[^<]+)"
...Not 100% sure what the issue is.
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
