Splunk Search

I need to extract xml tag values, but I dont want to use spath. how can i do it using regex?

nidhiagrawal
Explorer

Here is the sample xml. There will be only one of the below tags in xml.

<refToMessageId>-fd9035a:151642200c0:-37c2</refToMessageId>
<messageId>-fd9035a:151642200c0:-37c2</messageId>

I want to extract myMsgId, using regex.

0 Karma
1 Solution

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)

View solution in original post

0 Karma

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)
0 Karma

nidhiagrawal
Explorer

Thanks, and you are right I was trying to extract in myMsgId.

I looked at my data again and there is a minor issue. There is a request xml and response xml. Response xml has both elements <messageId> and <refToMessageId>. Request xml only has <messageId>. So the regex is capturing the messageId element, whereas I need to match it with <refToMessageId>. Can regex be modified to match it with refToMessageId, and if refToMessageId is not avaialble then match with messageId.

MessageId from request matches with refToMessageId from response. So I am trying to use these elements to evaluate response time.

("xyzRequest>" OR "xyzResponse>" ) "-fd9035a:151642200c0:-37c2" | stats earliest(_time) AS startTime, latest(_time) AS endTime | eval responseTime=endTime-startTime

0 Karma

sundareshr
Legend

This will extract from refToMessageId and get one value in a new field called msgId

\<refToMessageId\>(?<myRefMsgId>[^\<]+) | eval msgId=coalesce(myMsgId, myRefMsgId)

For what you are trying to do, have you looked at the transaction command. You could do something like

.. | transaction msdId startswith="xyzRequest" endswith="xyzResponse" | table msgId duration
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...