Dashboards & Visualizations

Why is Splunk query to extract string inside XML tag not working with spath command?

Communicator

I am using the following query:

index=itx "PAD =" | dedup BOC | spath output=Channel path=AsRunMessage.Header.Channel  | table BOC, channel

which results in events with big XML content .. I need to extract the string "ITX1546" from inside the tags.

Also, I need to create a table with distinct rows containing unique BOC values.

The Channel field is not being populated.

Here is the XML structure:

alt text

Any ideas? Thank you

0 Karma
1 Solution

Communicator

found my own answer.. .rex "]+>(?[^<]+)"

View solution in original post

0 Karma

Communicator

found my own answer.. .rex "]+>(?[^<]+)"

View solution in original post

0 Karma

Communicator
rex "<Channel [^>]+>(?<Channel>[^<]+)"
0 Karma