How can I build a regex to extract xml field value?

[praspai]

I want to extract XML field value ItemType and ItemNo from following XML. How can I build the Regular expression?

<impl:RetailItemList>
    <impl:VoRetailItem>
      <impl:ItemType>PPT</impl:ItemType>
      <impl:ItemNo>123456</impl:ItemNo>
      <impl:VoClassUnitKey>
        <impl:ClassType>BU</impl:ClassType>
        <impl:ClassUnitType>ST</impl:ClassUnitType>
        <impl:ClassUnitCode>0001</impl:ClassUnitCode>
      </impl:VoClassUnitKey>
    </impl:VoRetailItem>
  </impl:RetailItemList>

[niketn-deceased]

@praspai try the spath command for traversing xml or json:

| makeresults 
| eval _raw="<impl:RetailItemList>
     <impl:VoRetailItem>
       <impl:ItemType>PPT</impl:ItemType>
       <impl:ItemNo>123456</impl:ItemNo>
       <impl:VoClassUnitKey>
         <impl:ClassType>BU</impl:ClassType>
         <impl:ClassUnitType>ST</impl:ClassUnitType>
         <impl:ClassUnitCode>0001</impl:ClassUnitCode>
       </impl:VoClassUnitKey>
     </impl:VoRetailItem>
   </impl:RetailItemList>"
| spath

Above extracts all the fields but you can traverse and extract specific nodes as per need as well.

[suryaconsultant]

above code didn't work for me, can you pls help to understand what should be the issue

[skoelpin · Accepted solution]

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)

[richgalloway]

Before using regex, have you looked at the spath and xpath commands?

[praspai]

I want to extract these values as fields and search will be based on it. I didn't find the way to define it while adding the data source. I looked into it but I thought I can use these commands only in search.