Splunk Search

How to extract a string from a particular XML tags with regular expression?

Explorer

Dear Experts ,
Need your help with regular expression. I have an XML tag in the field f.
I would like to extract all the characters including spaces (or) Special characters from this XML string <Rmk>.
I tried to use search | rex field=f "\<Rmk\>"(?<Rmk>\w*)"\<\/Rmk\>" , however this regular expression is not giving any output.

your help is much appreciated with this query.

XML Tag :

<Rmk>ABC*/ Work Direct---</Rmk>

Desired Output : ABC*/ Work Direct---

Tags (3)
0 Karma
1 Solution

Legend

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

View solution in original post

Esteemed Legend

Just add ... | spath input=f, like this:

|makeresults | eval f="<Rmk>ABC*/ Work Direct---</Rmk>"

| spath input=f
0 Karma

Legend

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

View solution in original post

Legend

Hi kirangurram,
if you're satisfied of this solution, please accept and/or upvote it.
See next time.
Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

didn't see you commented there Giuseppe 🙂 deleting my answer 🙂

0 Karma

Explorer

thanks for your help @gcusello . Your solution works.

0 Karma