Splunk Search

How to extract many fields with a single regular expression ?

Allampally
Path Finder

Hi,

I have a sample log file as shown in the attached screenshot.
I have many such tags in the log file. I want to extract all time delay tags as a separate filed. It will be a tedious task to write separate regular expression for each tag. Is there any way to extract all the tags with single regular expression ?
How can i achieve this ?

alt text

Tags (1)
0 Karma

niketn
Legend

@Allampally, If your raw data is xml you can use KV_MODE=xml in your props.conf to extract all xml nodes at search time field discovery.

Alternatively you can can use spath command with your xml data, which should extract all xml nodes similar to above approach.

<yourCurrentSearch>
| spath

If you need Regex based extraction (Search Time using SPL or Transform) you can refer to the following answer for generic Regular Expression for extracting KV Pair from XML: https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Shan
Builder

@Allampally
Instead of screenshot.. Can you kindly post log sample here.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...