Getting Data In

Rex pattern to extract unc path from xml

splunk2019tlmd
Engager

I like to extract the UNC path from a log, below a portion from the file :

;<soa:FileSystem identifier="8ec65285-11ac-45a5-9652-425b7494b0df" name="Windows" description="Windows File System" leftaligncheckboxes="false" instance="102711ce-e483-46bc-bf6c-f42ae6faf234" signature="00000000-0000-0000-0000-000000000000" scheme="file" opencapable="true" consumeopen="true" emitopen="true"><soa:Location>file://fileserver/folder/folder1/folder2/</soa:Location

I like to have this part: //fileserver/folder/folder1/folder2

I have tried different rex combination without luck, any suggestions.

Thank you

Labels (1)
Tags (1)
0 Karma
1 Solution

memarshall63
Communicator

Maybe this will help...

| makeresults 
| eval mystring = "<soa:FileSystem identifier=\"8ec65285-11ac-45a5-9652-425b7494b0df\" name=\"Windows\" description=\"Windows File System\" leftaligncheckboxes=\"false\" instance=\"102711ce-e483-46bc-bf6c-f42ae6faf234\" signature=\"00000000-0000-0000-0000-000000000000\" scheme=\"file\" opencapable=\"true\" consumeopen=\"true\" emitopen=\"true\"><soa:Location>file://fileserver/folder/folder1/folder2/</soa:Location>"
| rex field=mystring "<soa:Location>file:(?P<filelocation>[^<]*)<\/soa:Location>"

View solution in original post

0 Karma

memarshall63
Communicator

Maybe this will help...

| makeresults 
| eval mystring = "<soa:FileSystem identifier=\"8ec65285-11ac-45a5-9652-425b7494b0df\" name=\"Windows\" description=\"Windows File System\" leftaligncheckboxes=\"false\" instance=\"102711ce-e483-46bc-bf6c-f42ae6faf234\" signature=\"00000000-0000-0000-0000-000000000000\" scheme=\"file\" opencapable=\"true\" consumeopen=\"true\" emitopen=\"true\"><soa:Location>file://fileserver/folder/folder1/folder2/</soa:Location>"
| rex field=mystring "<soa:Location>file:(?P<filelocation>[^<]*)<\/soa:Location>"
0 Karma

splunk2019tlmd
Engager

Thank you for answering,
If I add the exact portion it works, but this is part of a bigger log file that I extract other fields, how could I modified the |eval function for the whole search ?

0 Karma

memarshall63
Communicator

Sorry.. I don't know what you mean. You could just look for the file: string. So something like:

| rex field=mystring "file:(?P<filelocation>[^<]*)"

this just looks for "file:" and then grabs whatever comes after it.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...