Reporting

How to read only the first value to make a report?

nmarun
Explorer

Hi,

I have an xml response in the below format. I'm trying to read the BusinessId value of this. Since there are multiple, I want to read only the first one and use it as part of my report.

nmarun_0-1668436340018.png

This is how my query looks:

index=customer app_name="searchservice" | rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/" | table Client, MethodName, BusinessId,CorrelationId

nmarun_1-1668437000159.png

Fields Client, MethodName and CorrelationId have already been parsed out.

The issue I'm seeing is that if the response xml has multiple entries of BusinessId, it doesn't show up in the result as shown in the first two correlation ids. For the next two, the xml had only one instance BusinessId, so it showed up in the response.

How do I fix the regex to parse only the first instance and ignore the rest?

Thanks,

Arun

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"

View solution in original post

0 Karma

nmarun
Explorer

Thanks for your assistance on this.

0 Karma

nmarun
Explorer

https://regex101.com/r/Bri0g5/1 - please use this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"
0 Karma

nmarun
Explorer

Negative sir.

https://regex101.com/r/ttey6J/1 If there's a regex way to solve it, we can use this link.

0 Karma

nmarun
Explorer

Thanks for the response, but sorry, neither option worked. I tried putting both and that didn't help either.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*?)<\/"

or

| rex field=msg "BusinessId>(?P<BusinessId>[^<]*)<\/"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try

| rex max_match=1 field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"

or

| eval BusinessId=mvindex(BusinessId,0)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...