Splunk Search

How can I build a regex to extract xml field value?

praspai
Path Finder

I want to extract XML field value ItemType and ItemNo from following XML. How can I build the Regular expression?

<impl:RetailItemList>
    <impl:VoRetailItem>
      <impl:ItemType>PPT</impl:ItemType>
      <impl:ItemNo>123456</impl:ItemNo>
      <impl:VoClassUnitKey>
        <impl:ClassType>BU</impl:ClassType>
        <impl:ClassUnitType>ST</impl:ClassUnitType>
        <impl:ClassUnitCode>0001</impl:ClassUnitCode>
      </impl:VoClassUnitKey>
    </impl:VoRetailItem>
  </impl:RetailItemList>
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)

View solution in original post

0 Karma

niketn
Legend

@praspai try the spath command for traversing xml or json:

| makeresults 
| eval _raw="<impl:RetailItemList>
     <impl:VoRetailItem>
       <impl:ItemType>PPT</impl:ItemType>
       <impl:ItemNo>123456</impl:ItemNo>
       <impl:VoClassUnitKey>
         <impl:ClassType>BU</impl:ClassType>
         <impl:ClassUnitType>ST</impl:ClassUnitType>
         <impl:ClassUnitCode>0001</impl:ClassUnitCode>
       </impl:VoClassUnitKey>
     </impl:VoRetailItem>
   </impl:RetailItemList>"
| spath

Above extracts all the fields but you can traverse and extract specific nodes as per need as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

suryaconsultant
New Member

above code didn't work for me, can you pls help to understand what should be the issue

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Before using regex, have you looked at the spath and xpath commands?

---
If this reply helps you, Karma would be appreciated.
0 Karma

praspai
Path Finder

I want to extract these values as fields and search will be based on it. I didn't find the way to define it while adding the data source. I looked into it but I thought I can use these commands only in search.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...