Reporting

How to read only the first value to make a report?

nmarun
Explorer

Hi,

I have an xml response in the below format. I'm trying to read the BusinessId value of this. Since there are multiple, I want to read only the first one and use it as part of my report.

nmarun_0-1668436340018.png

This is how my query looks:

index=customer app_name="searchservice" | rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/" | table Client, MethodName, BusinessId,CorrelationId

nmarun_1-1668437000159.png

Fields Client, MethodName and CorrelationId have already been parsed out.

The issue I'm seeing is that if the response xml has multiple entries of BusinessId, it doesn't show up in the result as shown in the first two correlation ids. For the next two, the xml had only one instance BusinessId, so it showed up in the response.

How do I fix the regex to parse only the first instance and ignore the rest?

Thanks,

Arun

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"

View solution in original post

0 Karma

nmarun
Explorer

Thanks for your assistance on this.

0 Karma

nmarun
Explorer

https://regex101.com/r/Bri0g5/1 - please use this.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

While regex101.com is a good tool for learning regex, it is not Splunk. Try using makeresults to create sample data and test your regex there.

| makeresults 
| fields - _time
| eval msg="<Root><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node><Node><a:BusinessId>88</a:BusinessId></Node></Root>"
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"
| rex max_match=1 field=msg "BusinessId>(?P<BusinessId1>[0-9]*)<\/"
| rex field=msg "BusinessId>(?P<BusinessId2>[0-9]*?)<\/"
| rex field=msg "BusinessId>(?P<BusinessId3>[^<]*)<\/"
0 Karma

nmarun
Explorer

Negative sir.

https://regex101.com/r/ttey6J/1 If there's a regex way to solve it, we can use this link.

0 Karma

nmarun
Explorer

Thanks for the response, but sorry, neither option worked. I tried putting both and that didn't help either.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=msg "BusinessId>(?P<BusinessId>[0-9]*?)<\/"

or

| rex field=msg "BusinessId>(?P<BusinessId>[^<]*)<\/"
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try

| rex max_match=1 field=msg "BusinessId>(?P<BusinessId>[0-9]*)<\/"

or

| eval BusinessId=mvindex(BusinessId,0)
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...