Splunk Search

How to extract "myuserid" from my _raw event?

Path Finder

i want to retrieve myuserid from the below _raw event. please help me with rex in search.

<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n
0 Karma

Esteemed Legend

Try this:

... | rex "(?ms)<name>userid<\/name>[\r\n]*<lvalue>[\r\n]<string>(?<userid>.*)<\/string>"
0 Karma

Super Champion

Few assumptions
- Hope the above is NOT pure xml?
- assuming is a unique xml tag for myuserid

the regex is

| rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"

Example query

| makeresults | eval _raw="<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n " | rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"| table _raw,myuseridValue
0 Karma

SplunkTrust
SplunkTrust

Is it really a \n string in your data or they are representing new line? (your data is multiline)?

Also check if this works

your base search | rex "\<name\>userid([^\>]+\>){3}(?<userid>[^\<]+)"
0 Karma

Path Finder

\n is a string

0 Karma

SplunkTrust
SplunkTrust

Did you try the search I suggested?

0 Karma