Write Regex to capture words between containers?

[logankinman99]

I am a regex noob, and I was curious if there is a simple way to capture anything between containers.
For example,

<*Message>This is what I want to capture.<*/Message>

(Note: Please ignore the asterisks around Message...I had to use them as an escape character to make the containers appear.)

[arjunpkishore5 · Accepted solution]

This should do the trick

| rex "Message\>(?<message>[^\<]+)\<"

[logankinman99]

Thank you! This worked perfectly

[wenthold]

If you're looking to do this with in-line searching, you'll want to use the rex command to extract text with regex. If you're looking to do field extraction, you'll need to read up on props.conf and transforms.conf

Here is an in-line extraction example, using your message as a test value:

| makeresults
| eval message="<*Message>This is what I want to capture.<*/Message>"
| rex field=message ">(?<message_value>[^\<]+)<"

Regex101 is a great site for testing regular expression:

https://regex101.com/r/ihEPfj/1

Regex is far too deep a subject to really cover in a Splunk answers post, but there's a number of good sites that will provide some basic information, including a Splunk page ( Splunk and Regular Expressions ) but when I really wanted to dig in to regex I picked up "Mastering Regular Expressions" by Jeffrey Friedl and it definitely helped.

[kiamco]

this should do the trick

e\>(?<msg>[a-zA-Z .]+)<\/M