Splunk Enterprise

How to write a regular expression for a xml file

manidandu
Explorer

I need to mask data for fields values of <ab:Nm>, <ab:StrtNm>, <ab:PstCd>, <ab:TwnNm>, <ab:CtrySubDvsn>, <ab:Ctry>,  <ab:Ustrdfrom below events:

First Event:

<ab:Dbtr>
<ab:Nm>ACB L OESGT AGBDH</ab:Nm>
<ab:PstlAdr>
<ab:StrtNm>12345 BELBON WAY</ab:StrtNm>
<ab:PstCd>45352-1242</ab:PstCd>
<ab:TwnNm>CUBA TWP</ab:TwnNm>
<ab:CtrySubDvsn>AB</ab:CtrySubDvsn>
<ab:Ctry>CD</ab:Ctry>
</ab:PstlAdr>
</ab:Dbtr>
<ab:RmtInf>
<ab
:Ustrd>happy birthday 💖</ab:Ustrd>
<
/ab:RmtInf>

Second Event:

<ab:Dbtr>
<ab:Nm>AMIRA S ELHASSAN</ab:Nm>
<ab:PstlAdr>
<ab:StrtNm>5267 APHEG DR</ab:StrtNm>
<ab:PstCd>54672-1080</ab:PstCd>
<ab:TwnNm>ANTARTICA BEACH</ab:TwnNm>
<ab:CtrySubDvsn>EF</ab:CtrySubDvsn>
<ab:Ctry>CD</ab:Ctry>
</ab:PstlAdr>
</ab:Dbtr>
<ab:RmtInf>
<ab
:Ustrd>happy birthday, birthday party on me</ab:Ustrd>
<
/ab:RmtInf>


Third event:
<ab:Dbtr>
<ab
:Nm>ALYSSA FOSTER</ab:Nm>
<ab
:PstlAdr>
<ab
:StrtNm>529833 PRIME BILL CT</ab:StrtNm>
<ab
:PstCd>45673-8297</ab:PstCd>
<ab
:TwnNm>BEDERICK</ab:TwnNm>
<ab
:CtrySubDvsn>MD</ab:CtrySubDvsn>
<ab
:Ctry>CD</ab:Ctry>
<
/ab:PstlAdr>
<
/ab:Dbtr>
<ab:RmtInf>
<ab:Ustrd>happy birthday my love, have fun.</ab:Ustrd>
</ab:RmtInf>


Can someone help me with the regex? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
<ab:Nm>(?<Nm>[^<]+)<\/ab:Nm>

Repeat for each tag

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<ab:Nm>(?<Nm>[^<]+)<\/ab:Nm>

Repeat for each tag

0 Karma

manidandu
Explorer

Thanks for your help @ITWhisperer .. To mask these field values I can use sedcmd as below right?

SEDCMD-Test = s/<ab:Nm>(?<Nm>[^<]+)/<ab:Nm>########/g

Expected Output:

<ab:Nm>########</ab:Nm>

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...