Splunk Search

How can I build a regex to extract xml field value?

praspai
Path Finder

I want to extract XML field value ItemType and ItemNo from following XML. How can I build the Regular expression?

<impl:RetailItemList>
    <impl:VoRetailItem>
      <impl:ItemType>PPT</impl:ItemType>
      <impl:ItemNo>123456</impl:ItemNo>
      <impl:VoClassUnitKey>
        <impl:ClassType>BU</impl:ClassType>
        <impl:ClassUnitType>ST</impl:ClassUnitType>
        <impl:ClassUnitCode>0001</impl:ClassUnitCode>
      </impl:VoClassUnitKey>
    </impl:VoRetailItem>
  </impl:RetailItemList>
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)

View solution in original post

0 Karma

niketn
Legend

@praspai try the spath command for traversing xml or json:

| makeresults 
| eval _raw="<impl:RetailItemList>
     <impl:VoRetailItem>
       <impl:ItemType>PPT</impl:ItemType>
       <impl:ItemNo>123456</impl:ItemNo>
       <impl:VoClassUnitKey>
         <impl:ClassType>BU</impl:ClassType>
         <impl:ClassUnitType>ST</impl:ClassUnitType>
         <impl:ClassUnitCode>0001</impl:ClassUnitCode>
       </impl:VoClassUnitKey>
     </impl:VoRetailItem>
   </impl:RetailItemList>"
| spath

Above extracts all the fields but you can traverse and extract specific nodes as per need as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

suryaconsultant
New Member

above code didn't work for me, can you pls help to understand what should be the issue

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Before using regex, have you looked at the spath and xpath commands?

---
If this reply helps you, Karma would be appreciated.
0 Karma

praspai
Path Finder

I want to extract these values as fields and search will be based on it. I didn't find the way to define it while adding the data source. I looked into it but I thought I can use these commands only in search.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...