Splunk Search

How do I get a value from a field as described in the following example?

vaibhavvijay9
New Member
some normal text.......and in between 

    <ns0:ExceptionLog_Action>

        <ns0:Exception>

         <ns0:Code>111</ns0:Code>

         <ns0:Reason>ErrorCode: Life-003&#xD;Reason: Mapping error in Web Service &#xD;Stacktrace...(other sub-fields)</ns0:Reason>


        </ns0:Exception>

    </ns0:ExceptionLog_Action>

I want the value of Reason: inside <ns0:Reason> before &#xD; that is : Mapping error in Web Service

Please help me to do so.

Thanks In Advance

Vaibhav Vijay

Tags (1)
0 Karma
1 Solution

whrg
Motivator

Hello Vaibhav,

I can see that "Mapping error in Web Service" is prefixed by "Reason:"

With that in mind, check out this regex:

Reason: (?<Reason>[^&]+) &#xD

This is how you can verify:

| makeresults count=1
| eval _raw="some normal text.......and in between <ns0:ExceptionLog_Action> <ns0:Exception> <ns0:Code>111</ns0:Code> <ns0:Reason>ErrorCode: Life-003&#xD;Reason: Mapping error in Web Service &#xD;Stacktrace...(other sub-fields)</ns0:Reason> </ns0:Exception> </ns0:ExceptionLog_Action>"
| rex field=_raw "Reason: (?<Reason>[^&]+) &#xD"

View solution in original post

0 Karma

whrg
Motivator

Hello Vaibhav,

I can see that "Mapping error in Web Service" is prefixed by "Reason:"

With that in mind, check out this regex:

Reason: (?<Reason>[^&]+) &#xD

This is how you can verify:

| makeresults count=1
| eval _raw="some normal text.......and in between <ns0:ExceptionLog_Action> <ns0:Exception> <ns0:Code>111</ns0:Code> <ns0:Reason>ErrorCode: Life-003&#xD;Reason: Mapping error in Web Service &#xD;Stacktrace...(other sub-fields)</ns0:Reason> </ns0:Exception> </ns0:ExceptionLog_Action>"
| rex field=_raw "Reason: (?<Reason>[^&]+) &#xD"
0 Karma

vaibhavvijay9
New Member

Thanks a lot Whrg!!

I am really grateful for your help, it has been incredibly helpful to me.

Regards,
Vaibhav Vijay

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...