Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Highlighted
Solved! Jump to solution

How to remove contents between tags in XML with regex?

SplunkCSIT
Communicator
‎04-20-2014 05:23 AM

Hi,
What will be the likely regex to remove the contents of the and tag for the following xml?
I tried regex: (. * ?)<body>. * ?</body>(. * ?)<content>. * ?(. * )

but it does not work because there are a few whitespaces in the contents of the and tag. thks


<!--test-->12123451234hQIOA68nz9GqU7SREAgAxWfwvpziO4N6KquxmeuYD/txfTceyXRZGVqAGFUGmOdE
+K9PCLp/+p3cFC8OcOZg8WReI4wlpYzgS3/XsB4LL9MegSHwjjI9jNsnQOr9EeLA
IgDEb1NeXZ499qnSY1ZvCy/VCF1O7H71y77VQTckpfyHgWvzkaaaheMC0r+JGLZO
0w3NCTERFJ8XaXKz/+qw4gA7xxbpT9nXVXMwEwYgiAviJBJhdYw63oTlRYGgGzPh
H2YVNv2TWnpWp816xi+sbM1ZsJJERnAZSADKFYZzYw4E73VhUlrX5YBY4WN7UmQw
kUmsZUX709sMBHZN/9aniaVBsLxszHw9xu5OuSz/lHkckplcwb94XDLh1KGGO+1Q
LzbpFYPqe3BANLK5xxlQAAti/uk0XYltVJfUOCzyxl282X3Tp/77FtiGGb8RI1HY
hslojkAQa9gK1+f44Y8LwHH5k7fQr+Q+luqP7inoEQWbpWW4hu80Wkafv/bzI/xu
Z1qGcEVcJGJPP7QwQWUp53FbZuIq742CoxNklwvlnjhEaXa5rG2dmHUREawVzz+q
M8RkPBZIBge0SVY=
=WznL3=3355533LttrtjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEVqYxUZGT6YWtWLSlbCQNxOF
ChDSQpu30B5MIAaR+j8/FfrAmERlXv7RWzY5mb/4InvUoDF4Bs10Rqb2twHNsyLPpW9FTeQ7Z3ftaXShK
cyPeh6zOvMwDRKLxdQ=endofcontentjWDgAy5cp6+EnitDkTUiIaXMsN6tW5rEFQsTabuSm8kW7CMUEV=
-retREREEEF
Rendofcontent333333833

Tags (2)
0 Karma
Reply
1 Solution
Highlighted
Solved! Jump to solution

Re: How to remove contents between tags in XML with regex?

jgedeon120
Contributor
‎04-20-2014 06:30 AM 
<body>.+<\/body>|<cont>.+<\/cont>

A site that will help you test regex, http://www.regexr.com/

Reply
Highlighted
Solved! Jump to solution
Solution

Re: How to remove contents between tags in XML with regex?

SplunkCSIT
Communicator
‎04-27-2014 01:39 AM

I seems able to resolve my query by configuring transforms.conf as below:

SOURCEKEY=raw

REGEX = (. * ?)< body \ >([\s\S] * )<\/ body \ >([\s\S] * ) \ < cont \ > ([\s\S] * )< \ / cont \ >([\s\S] *)

DESTKEY=raw

FORMAT=$1< body>###***#< /body>$3< cont>###< /cont>$5

View solution in original post

Reply