Splunk Search

Help with regex

vrmandadi
Builder

I have the below sample data

sample 1
`<TargetCode key="Zip5">78216</TargetCode>`

sample 2

<adm:TargetCode key="Zip5" account="1">78216</adm:TargetCode>

I am using the below regex
*\"Zip5\"|>(?<ZipCode>.*?)\<\/.* ...but this is not extracting the one in sample 2.

Thanks in advance

0 Karma
1 Solution

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

niketn
Legend

Please try the following run anywhere code based on your sample data:

| makeresults
| eval sample="<TargetCode key=\"Zip5\">78216</TargetCode>"
| append [| makeresults
| eval sample="<adm:TargetCode key=\"Zip5\" account=\"1\">78216</adm:TargetCode>"]
| rex field=sample "key=\"Zip5\".*\>(?<Zip5>[^\<]+)\<\/"
| table sample Zip5

Your data seems to be xml. Any reason for not having KV_MODE=xml in props.conf or not using spath with your raw data?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

micahkemp
Champion

Try Zip5[^>]+>([^>]+)<

0 Karma

nickhills
Ultra Champion

Hows this?
Zip5".*?\>(?<ZIP>\d+)\<

amended to extract to "Zip"

If my comment helps, please give it a thumbs up!
0 Karma

vrmandadi
Builder

It worked.Thanks

0 Karma

somesoni2
Revered Legend

Which value you want to extract and what's the field name? Please format the code/regex by selecting it and pressing Ctrl+K so that formatting is retained.

0 Karma

vrmandadi
Builder

I want to extract the 78216 into field called ZIP

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...