Splunk Search

Help with regex

vrmandadi
Builder

I have the below sample data

sample 1
`<TargetCode key="Zip5">78216</TargetCode>`

sample 2

<adm:TargetCode key="Zip5" account="1">78216</adm:TargetCode>

I am using the below regex
*\"Zip5\"|>(?<ZipCode>.*?)\<\/.* ...but this is not extracting the one in sample 2.

Thanks in advance

0 Karma
1 Solution

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

niketn
Legend

Please try the following run anywhere code based on your sample data:

| makeresults
| eval sample="<TargetCode key=\"Zip5\">78216</TargetCode>"
| append [| makeresults
| eval sample="<adm:TargetCode key=\"Zip5\" account=\"1\">78216</adm:TargetCode>"]
| rex field=sample "key=\"Zip5\".*\>(?<Zip5>[^\<]+)\<\/"
| table sample Zip5

Your data seems to be xml. Any reason for not having KV_MODE=xml in props.conf or not using spath with your raw data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

micahkemp
Champion

Try Zip5[^>]+>([^>]+)<

0 Karma

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!
0 Karma

vrmandadi
Builder

It worked.Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Which value you want to extract and what's the field name? Please format the code/regex by selecting it and pressing Ctrl+K so that formatting is retained.

0 Karma

vrmandadi
Builder

I want to extract the 78216 into field called ZIP

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...