Splunk IT Service Intelligence

Write Regex to capture words between containers?

logankinman99
Path Finder

I am a regex noob, and I was curious if there is a simple way to capture anything between containers.
For example,

<*Message>This is what I want to capture.<*/Message>

(Note: Please ignore the asterisks around Message...I had to use them as an escape character to make the containers appear.)

0 Karma
1 Solution

arjunpkishore5
Motivator

This should do the trick

| rex "Message\>(?<message>[^\<]+)\<"

View solution in original post

arjunpkishore5
Motivator

This should do the trick

| rex "Message\>(?<message>[^\<]+)\<"

View solution in original post

logankinman99
Path Finder

Thank you! This worked perfectly

0 Karma

wenthold
Communicator

If you're looking to do this with in-line searching, you'll want to use the rex command to extract text with regex. If you're looking to do field extraction, you'll need to read up on props.conf and transforms.conf

Here is an in-line extraction example, using your message as a test value:

| makeresults
| eval message="<*Message>This is what I want to capture.<*/Message>"
| rex field=message ">(?<message_value>[^\<]+)<"

Regex101 is a great site for testing regular expression:

https://regex101.com/r/ihEPfj/1

Regex is far too deep a subject to really cover in a Splunk answers post, but there's a number of good sites that will provide some basic information, including a Splunk page ( Splunk and Regular Expressions ) but when I really wanted to dig in to regex I picked up "Mastering Regular Expressions" by Jeffrey Friedl and it definitely helped.

kiamco
Path Finder

this should do the trick

e\>(?<msg>[a-zA-Z .]+)<\/M

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!