Splunk Search

How to extract a string from a particular XML tags with regular expression?

kirangurram
Explorer

Dear Experts ,
Need your help with regular expression. I have an XML tag in the field f.
I would like to extract all the characters including spaces (or) Special characters from this XML string <Rmk>.
I tried to use search | rex field=f "\<Rmk\>"(?<Rmk>\w*)"\<\/Rmk\>" , however this regular expression is not giving any output.

your help is much appreciated with this query.

XML Tag :

<Rmk>ABC*/ Work Direct---</Rmk>

Desired Output : ABC*/ Work Direct---

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

View solution in original post

woodcock
Esteemed Legend

Just add ... | spath input=f, like this:

|makeresults | eval f="<Rmk>ABC*/ Work Direct---</Rmk>"

| spath input=f
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
if you're satisfied of this solution, please accept and/or upvote it.
See next time.
Bye.
Giuseppe

0 Karma

DavidHourani
Super Champion

didn't see you commented there Giuseppe 🙂 deleting my answer 🙂

0 Karma

kirangurram
Explorer

thanks for your help @gcusello . Your solution works.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...