@somesoni2
I am trying to parse a complex xml and asking about the regex for SEDCMD-abremoveheader which refers to line 3 of the xml or further below. (*s) works in regex101.com but not in Splunk SEDCMD-abremoveheader.
The below solution is NOT SUFFICIENT because it refers to the first 2 lines only.
https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-and-props-conf-help/m-p/158263
Details:
I use SEDCMD-abremoveheader to start from the desired location.
I works when it is about the first two lines.
It does not work when it is the 3rd or any other line further below.
Here is an example xml:
<?xml version="1.0"?>
<config version="8.1.0" daaa="dummy">
<something>
The following works fine in Splunk xml parsing:
SEDCMD-abremoveheader = s/\<\?xml.*\s*\<config.*\>\s*//g
The following does not work in splunk xml parsing and also not in regex101.com
SEDCMD-abremoveheader = s/\<\?xml.*\s*\<somthing.*\>\s*//g
The following ***works in regx101.com*** but not in Splunk xml parsing:
(?s)\<\?xml.*\s*\<something.*\>\s*
The (?s) says to ignore any char including new lines.
Also tried (?m) - does not work either.
