Reporting

How to read only the first value to make a report?

nmarun
Explorer

Hi,

I have an xml response in the below format. I'm trying to read the BusinessId value of this. Since there are multiple, I want to read only the first one and use it as part of my report.

nmarun_0-1668436340018.png

This is how my query looks:

index=customer app_name="searchservice" | rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/" | table Client, MethodName, BusinessId,CorrelationId

nmarun_1-1668437000159.png

Fields Client, MethodName and CorrelationId have already been parsed out.

The issue I'm seeing is that if the response xml has multiple entries of BusinessId, it doesn't show up in the result as shown in the first two correlation ids. For the next two, the xml had only one instance BusinessId, so it showed up in the response.

How do I fix the regex to parse only the first instance and ignore the rest?

Thanks,

Arun

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"

View solution in original post

0 Karma

nmarun
Explorer

Thanks for your assistance on this.

0 Karma

nmarun
Explorer

https://regex101.com/r/Bri0g5/1 - please use this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"
0 Karma

nmarun
Explorer

Negative sir.

https://regex101.com/r/ttey6J/1 If there's a regex way to solve it, we can use this link.

0 Karma

nmarun
Explorer

Thanks for the response, but sorry, neither option worked. I tried putting both and that didn't help either.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*?)<\/"

or

| rex field=msg "BusinessId>(?P<BusinessId>[^<]*)<\/"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try

| rex max_match=1 field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"

or

| eval BusinessId=mvindex(BusinessId,0)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...