Splunk Search

How to extract an XML element attribute which has a space and no quotation marks?

wuwangjun
New Member

Hi Guys,

I have the below XML in a log file:

I can't get the the name attribute via "path="Customer{@value}")" patter. I also can't get the other elements after customer

Can anybody help me please?

BR

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

View solution in original post

0 Karma

ppablo
Retired

@wuwangjun

Please edit your question to include your XML code you meant to share. Click on the gear icon to the right of your question's title and click Edit. After you paste your XML, highlight all of that code and, as @jkat54 says, click on the Code Sample button in the text editing tools. This will ensure your XML renders properly on this site.

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the "code sample/blocks" button to put your xml code in blocks. Or use a site like pastebin.com if you still cant get the code to show up.

if you use the single leaning quote (below ~ tilda on my keyboard) it quotes the xml and html tags very well
<example>test</example>

richgalloway
SplunkTrust
SplunkTrust

Where is the "below xml"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...