Splunk Search

Help with regex

vrmandadi
Builder

I have the below sample data

sample 1
`<TargetCode key="Zip5">78216</TargetCode>`

sample 2

<adm:TargetCode key="Zip5" account="1">78216</adm:TargetCode>

I am using the below regex
*\"Zip5\"|>(?<ZipCode>.*?)\<\/.* ...but this is not extracting the one in sample 2.

Thanks in advance

0 Karma
1 Solution

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

niketn
Legend

Please try the following run anywhere code based on your sample data:

| makeresults
| eval sample="<TargetCode key=\"Zip5\">78216</TargetCode>"
| append [| makeresults
| eval sample="<adm:TargetCode key=\"Zip5\" account=\"1\">78216</adm:TargetCode>"]
| rex field=sample "key=\"Zip5\".*\>(?<Zip5>[^\<]+)\<\/"
| table sample Zip5

Your data seems to be xml. Any reason for not having KV_MODE=xml in props.conf or not using spath with your raw data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

micahkemp
Champion

Try Zip5[^>]+>([^>]+)<

0 Karma

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!
0 Karma

vrmandadi
Builder

It worked.Thanks

0 Karma

somesoni2
Revered Legend

Which value you want to extract and what's the field name? Please format the code/regex by selecting it and pressing Ctrl+K so that formatting is retained.

0 Karma

vrmandadi
Builder

I want to extract the 78216 into field called ZIP

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...