Splunk Search

I need to extract xml tag values, but I dont want to use spath. how can i do it using regex?

nidhiagrawal
Explorer

Here is the sample xml. There will be only one of the below tags in xml.

<refToMessageId>-fd9035a:151642200c0:-37c2</refToMessageId>
<messageId>-fd9035a:151642200c0:-37c2</messageId>

I want to extract myMsgId, using regex.

0 Karma
1 Solution

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)

View solution in original post

0 Karma

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)
0 Karma

nidhiagrawal
Explorer

Thanks, and you are right I was trying to extract in myMsgId.

I looked at my data again and there is a minor issue. There is a request xml and response xml. Response xml has both elements <messageId> and <refToMessageId>. Request xml only has <messageId>. So the regex is capturing the messageId element, whereas I need to match it with <refToMessageId>. Can regex be modified to match it with refToMessageId, and if refToMessageId is not avaialble then match with messageId.

MessageId from request matches with refToMessageId from response. So I am trying to use these elements to evaluate response time.

("xyzRequest>" OR "xyzResponse>" ) "-fd9035a:151642200c0:-37c2" | stats earliest(_time) AS startTime, latest(_time) AS endTime | eval responseTime=endTime-startTime

0 Karma

sundareshr
Legend

This will extract from refToMessageId and get one value in a new field called msgId

\<refToMessageId\>(?<myRefMsgId>[^\<]+) | eval msgId=coalesce(myMsgId, myRefMsgId)

For what you are trying to do, have you looked at the transaction command. You could do something like

.. | transaction msdId startswith="xyzRequest" endswith="xyzResponse" | table msgId duration
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...