Extracting XML data attributes from message field

[paddy3883]

I have XML data stored for an field in my Splunk events and am looking to extract an attribute contained within one of the elements For example, an event will look like


LogName=Application
SourceName=MyApplication
Type=Error
Message=<Exception type="SomeType.Value" message="The value I wanted" ....></Exception>
....


How can I extract the message attribute values for the matching events?

[asimagu · Accepted solution]

a regex will always do the magic you need

| rex "\smessage=\"(?P<FIELDNAME>[^\"]+)\""

[paddy3883]

Excellent, many thanks. This worked a treat