Splunk Search

How to remove tags in a string?

vnguyen46
Contributor

Hello,

I have a string field like: View
How can I remove tag and to only display View in the search?

Thanks,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It will help to see some sample events and the desired output.

---
If this reply helps you, Karma would be appreciated.

vnguyen46
Contributor

Sorry for the confusing and here is the detail:

Search: index=index1 | table eventdata
Current output: 
eventdata
<Type> View </Type> 
<Action> Edit </Action>
 <Source> Server Name </Source>

Desired output:
eventdata
View
Edit
Server Name

0 Karma

vnguyen46
Contributor

Wow, I see where it causes confusing. The tags were removed from my original post. That makes both current and desired outputs the same.
The current output has smaller and greater signs at beginning and these signs with at the end.

0 Karma

woodcock
Esteemed Legend

It got eaten again. Re-edit your original question, highlight the stuff that is getting changed and then click the 101010 button to make it a code fragment that will not get modified.

0 Karma

vnguyen46
Contributor

Sorry, actually the field name is EventData with values like: View or Edit or Delete
I try to only display the text b/w tags and (View, Edit, or Delete).

Thanks,

0 Karma

woodcock
Esteemed Legend

I have no idea what you mean. Use more works and try the markdown features in answers.

0 Karma

vnguyen46
Contributor

Hi Woodcock,
All I meant is that how I can remove tags .... in a string. For example:
View , I only need my search to return View. The field name is EventData.

Thanks,

0 Karma

woodcock
Esteemed Legend

You said the same thing 3 times the same way and it doesn't make sense. Draw us a picture and stop using words. Show us the data before and the data after. We are not following what you mean, especially your strange use of the term tag.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command may be what you are looking for. The example below will extract what is between <tag> and < into a field called 'field'.

... | rex "\<[^>]+>\s*(?<field>[^\<]+)\<"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...