Splunk Search

How to remove contents between tags in XML with regex?

SplunkCSIT
Communicator

Hi,
What will be the likely regex to remove the contents of the and tag for the following xml?
I tried regex: (. * ?)<body>. * ?</body>(. * ?)<content>. * ?
(. * )

but it does not work because there are a few whitespaces in the contents of the and tag. thks


<!--test-->12123451234hQIOA68nz9GqU7SREAgAxWfwvpziO4N6KquxmeuYD/txfTceyXRZGVqAGFUGmOdE
+K9PCLp/+p3cFC8OcOZg8WReI4wlpYzgS3/XsB4LL9MegSHwjjI9jNsnQOr9EeLA
IgDEb1NeXZ499qnSY1ZvCy/VCF1O7H71y77VQTckpfyHgWvzkaaaheMC0r+JGLZO
0w3NCTERFJ8XaXKz/+qw4gA7xxbpT9nXVXMwEwYgiAviJBJhdYw63oTlRYGgGzPh
H2YVNv2TWnpWp816xi+sbM1ZsJJERnAZSADKFYZzYw4E73VhUlrX5YBY4WN7UmQw
kUmsZUX709sMBHZN/9aniaVBsLxszHw9xu5OuSz/lHkckplcwb94XDLh1KGGO+1Q
LzbpFYPqe3BANLK5xxlQAAti/uk0XYltVJfUOCzyxl282X3Tp/77FtiGGb8RI1HY
hslojkAQa9gK1+f44Y8LwHH5k7fQr+Q+luqP7inoEQWbpWW4hu80Wkafv/bzI/xu
Z1qGcEVcJGJPP7QwQWUp53FbZuIq742CoxNklwvlnjhEaXa5rG2dmHUREawVzz+q
M8RkPBZIBge0SVY=
=WznL3=3355533LttrtjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEVqYxUZGT6YWtWLSlbCQNxOF
ChDSQpu30B5MIAaR+j8/FfrAmERlXv7RWzY5mb/4InvUoDF4Bs10Rqb2twHNsyLPpW9FTeQ7Z3ftaXShK
cyPeh6zOvMwDRKLxdQ=endofcontentjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEV=
-retREREEEF
Rendofcontent
333333833

Tags (2)
0 Karma
1 Solution

SplunkCSIT
Communicator

I seems able to resolve my query by configuring transforms.conf as below:

SOURCE_KEY=_raw

REGEX = (. * ?)< body \ >([\s\S] * )<\/ body \ >([\s\S] * ) \ < cont \ > ([\s\S] * )< \ / cont \ >([\s\S] *)

DEST_KEY=_raw

FORMAT=$1< body>###***#< /body>$3< cont>###< /cont>$5

View solution in original post

SplunkCSIT
Communicator

I seems able to resolve my query by configuring transforms.conf as below:

SOURCE_KEY=_raw

REGEX = (. * ?)< body \ >([\s\S] * )<\/ body \ >([\s\S] * ) \ < cont \ > ([\s\S] * )< \ / cont \ >([\s\S] *)

DEST_KEY=_raw

FORMAT=$1< body>###***#< /body>$3< cont>###< /cont>$5

jgedeon120
Contributor
<body>.+<\/body>|<cont>.+<\/cont>

A site that will help you test regex, http://www.regexr.com/

Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...