How to extract many fields with a single regular expression ?

[Allampally]

Hi,

I have a sample log file as shown in the attached screenshot.
I have many such tags in the log file. I want to extract all time delay tags as a separate filed. It will be a tedious task to write separate regular expression for each tag. Is there any way to extract all the tags with single regular expression ?
How can i achieve this ?

[niketn]

@Allampally, If your raw data is xml you can use KV_MODE=xml in your props.conf to extract all xml nodes at search time field discovery.

Alternatively you can can use spath command with your xml data, which should extract all xml nodes similar to above approach.

<yourCurrentSearch>
| spath

If you need Regex based extraction (Search Time using SPL or Transform) you can refer to the following answer for generic Regular Expression for extracting KV Pair from XML: https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html

[Shan]

@Allampally
Instead of screenshot.. Can you kindly post log sample here.