Splunk Search
Highlighted

How to remove contents between tags in XML with regex?

Communicator

Hi,
What will be the likely regex to remove the contents of the and tag for the following xml?
I tried regex: (. * ?)<body>. * ?</body>(. * ?)<content>. * ?
(. * )

but it does not work because there are a few whitespaces in the contents of the and tag. thks


<!--test-->12123451234hQIOA68nz9GqU7SREAgAxWfwvpziO4N6KquxmeuYD/txfTceyXRZGVqAGFUGmOdE
+K9PCLp/+p3cFC8OcOZg8WReI4wlpYzgS3/XsB4LL9MegSHwjjI9jNsnQOr9EeLA
IgDEb1NeXZ499qnSY1ZvCy/VCF1O7H71y77VQTckpfyHgWvzkaaaheMC0r+JGLZO
0w3NCTERFJ8XaXKz/+qw4gA7xxbpT9nXVXMwEwYgiAviJBJhdYw63oTlRYGgGzPh
H2YVNv2TWnpWp816xi+sbM1ZsJJERnAZSADKFYZzYw4E73VhUlrX5YBY4WN7UmQw
kUmsZUX709sMBHZN/9aniaVBsLxszHw9xu5OuSz/lHkckplcwb94XDLh1KGGO+1Q
LzbpFYPqe3BANLK5xxlQAAti/uk0XYltVJfUOCzyxl282X3Tp/77FtiGGb8RI1HY
hslojkAQa9gK1+f44Y8LwHH5k7fQr+Q+luqP7inoEQWbpWW4hu80Wkafv/bzI/xu
Z1qGcEVcJGJPP7QwQWUp53FbZuIq742CoxNklwvlnjhEaXa5rG2dmHUREawVzz+q
M8RkPBZIBge0SVY=
=WznL3=3355533LttrtjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEVqYxUZGT6YWtWLSlbCQNxOF
ChDSQpu30B5MIAaR+j8/FfrAmERlXv7RWzY5mb/4InvUoDF4Bs10Rqb2twHNsyLPpW9FTeQ7Z3ftaXShK
cyPeh6zOvMwDRKLxdQ=endofcontentjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEV=
-retREREEEF
Rendofcontent
333333833

Tags (2)
0 Karma
Highlighted

Re: How to remove contents between tags in XML with regex?

Contributor
<body>.+<\/body>|<cont>.+<\/cont>

A site that will help you test regex, http://www.regexr.com/

Highlighted

Re: How to remove contents between tags in XML with regex?

Communicator

I seems able to resolve my query by configuring transforms.conf as below:

SOURCEKEY=raw

REGEX = (. * ?)< body \ >([\s\S] * )<\/ body \ >([\s\S] * ) \ < cont \ > ([\s\S] * )< \ / cont \ >([\s\S] *)

DESTKEY=raw

FORMAT=$1< body>###***#< /body>$3< cont>###< /cont>$5

View solution in original post