display specific content from message

[Leon88]

I have a below message. how can I only display ResponseID in output? thanks

message: <?xml version='1.0' encoding='ISO-8859-1'?><Submission Id="12345" <LastName>XXX</LastName><ResponseID>137ce83fe8ddb052-1698535326634</ResponseID><Date>2023.10.28 23:23:14</Date>

[gcusello · Accepted solution]

Hi @Leon88,

you have to use a regex to extract this field, something like this:

index=your_index
| rex "\<ResponseID\>(?<ResponseID>[^\<]*)"
| table _time ResponseID

that you can test at https://regex101.com/r/Sj8hDe/1

Ciao.

Giuseppe

[gcusello]

Hi @Leon88 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉