Splunk Search

How to extract "myuserid" from my _raw event?

Path Finder

i want to retrieve myuserid from the below _raw event. please help me with rex in search.

<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n
0 Karma

Esteemed Legend

Try this:

... | rex "(?ms)<name>userid<\/name>[\r\n]*<lvalue>[\r\n]<string>(?<userid>.*)<\/string>"
0 Karma

Super Champion

Few assumptions
- Hope the above is NOT pure xml?
- assuming is a unique xml tag for myuserid

the regex is

| rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"

Example query

| makeresults | eval _raw="<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n " | rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"| table _raw,myuseridValue
0 Karma

Revered Legend

Is it really a \n string in your data or they are representing new line? (your data is multiline)?

Also check if this works

your base search | rex "\<name\>userid([^\>]+\>){3}(?<userid>[^\<]+)"
0 Karma

Path Finder

\n is a string

0 Karma

Revered Legend

Did you try the search I suggested?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!