Splunk Search

How to extract an XML element attribute which has a space and no quotation marks?

wuwangjun
New Member

Hi Guys,

I have the below XML in a log file:

I can't get the the name attribute via "path="Customer{@value}")" patter. I also can't get the other elements after customer

Can anybody help me please?

BR

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

View solution in original post

0 Karma

ppablo
Community Manager
Community Manager

@wuwangjun

Please edit your question to include your XML code you meant to share. Click on the gear icon to the right of your question's title and click Edit. After you paste your XML, highlight all of that code and, as @jkat54 says, click on the Code Sample button in the text editing tools. This will ensure your XML renders properly on this site.

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the "code sample/blocks" button to put your xml code in blocks. Or use a site like pastebin.com if you still cant get the code to show up.

if you use the single leaning quote (below ~ tilda on my keyboard) it quotes the xml and html tags very well
<example>test</example>

richgalloway
SplunkTrust
SplunkTrust

Where is the "below xml"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...