Getting Data In

Extracting XML data attributes from message field

paddy3883
Path Finder

I have XML data stored for an field in my Splunk events and am looking to extract an attribute contained within one of the elements For example, an event will look like


LogName=Application
SourceName=MyApplication
Type=Error
Message=<Exception type="SomeType.Value" message="The value I wanted" ....></Exception>
....

How can I extract the message attribute values for the matching events?

Tags (1)
0 Karma
1 Solution

asimagu
Builder

a regex will always do the magic you need

| rex "\smessage=\"(?P<FIELDNAME>[^\"]+)\""

View solution in original post

0 Karma

asimagu
Builder

a regex will always do the magic you need

| rex "\smessage=\"(?P<FIELDNAME>[^\"]+)\""
0 Karma

paddy3883
Path Finder

Excellent, many thanks. This worked a treat

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...