Splunk Search

Extract string within specific tag

kirangurram
Explorer

Hello Experts ,
Need your assistance to extract output from one of the below XML tags.
I have three XML tags with same naming convention and I want only extract specific value 3 from the below tags.
can you help me to provide rex commend (or) any other commend which will only extract value 3 from the below tags.

<Val Ty="CHAR">Feedback</Val>
<Val Ty="CHAR">3</Val>
<Val Ty="CHAR">TRST</Val>

your help is much appreciated.

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

|makeresults  |eval tag="<Val Ty=\"CHAR\">Feedback</Val>
<Val Ty=\"CHAR\">3</Val>
<Val Ty=\"CHAR\">TRST</Val>" |rex field=tag "CHAR\"\>(?P<output>(\d+))\<"

OR

| makeresults 
| eval tag="<Val Ty=\"CHAR\">Feedback</Val>
 <Val Ty=\"CHAR\">3</Val>
 <Val Ty=\"CHAR\">TRST</Val>" 
| rex field=tag max_match=0 "\"CHAR\">(?P<output>.+)<" 
| eval result = mvindex(output,1)

View solution in original post

0 Karma

kirangurram
Explorer

Thanks @vnravikumar , below solution works.
Second solution didnt give me desired results.

|makeresults |eval tag="Feedback
3
TRST" |rex field=tag "CHAR\">(?P(\d+))<"

0 Karma

vnravikumar
Champion

Hi

Try this

|makeresults  |eval tag="<Val Ty=\"CHAR\">Feedback</Val>
<Val Ty=\"CHAR\">3</Val>
<Val Ty=\"CHAR\">TRST</Val>" |rex field=tag "CHAR\"\>(?P<output>(\d+))\<"

OR

| makeresults 
| eval tag="<Val Ty=\"CHAR\">Feedback</Val>
 <Val Ty=\"CHAR\">3</Val>
 <Val Ty=\"CHAR\">TRST</Val>" 
| rex field=tag max_match=0 "\"CHAR\">(?P<output>.+)<" 
| eval result = mvindex(output,1)
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...