Splunk Search

Extract string within specific tag

kirangurram
Explorer

Hello Experts ,
Need your assistance to extract output from one of the below XML tags.
I have three XML tags with same naming convention and I want only extract specific value 3 from the below tags.
can you help me to provide rex commend (or) any other commend which will only extract value 3 from the below tags.

<Val Ty="CHAR">Feedback</Val>
<Val Ty="CHAR">3</Val>
<Val Ty="CHAR">TRST</Val>

your help is much appreciated.

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

|makeresults  |eval tag="<Val Ty=\"CHAR\">Feedback</Val>
<Val Ty=\"CHAR\">3</Val>
<Val Ty=\"CHAR\">TRST</Val>" |rex field=tag "CHAR\"\>(?P<output>(\d+))\<"

OR

| makeresults 
| eval tag="<Val Ty=\"CHAR\">Feedback</Val>
 <Val Ty=\"CHAR\">3</Val>
 <Val Ty=\"CHAR\">TRST</Val>" 
| rex field=tag max_match=0 "\"CHAR\">(?P<output>.+)<" 
| eval result = mvindex(output,1)

View solution in original post

0 Karma

kirangurram
Explorer

Thanks @vnravikumar , below solution works.
Second solution didnt give me desired results.

|makeresults |eval tag="Feedback
3
TRST" |rex field=tag "CHAR\">(?P(\d+))<"

0 Karma

vnravikumar
Champion

Hi

Try this

|makeresults  |eval tag="<Val Ty=\"CHAR\">Feedback</Val>
<Val Ty=\"CHAR\">3</Val>
<Val Ty=\"CHAR\">TRST</Val>" |rex field=tag "CHAR\"\>(?P<output>(\d+))\<"

OR

| makeresults 
| eval tag="<Val Ty=\"CHAR\">Feedback</Val>
 <Val Ty=\"CHAR\">3</Val>
 <Val Ty=\"CHAR\">TRST</Val>" 
| rex field=tag max_match=0 "\"CHAR\">(?P<output>.+)<" 
| eval result = mvindex(output,1)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...