Splunk Search

I need to extract xml tag values, but I dont want to use spath. how can i do it using regex?

nidhiagrawal
Explorer

Here is the sample xml. There will be only one of the below tags in xml.

<refToMessageId>-fd9035a:151642200c0:-37c2</refToMessageId>
<messageId>-fd9035a:151642200c0:-37c2</messageId>

I want to extract myMsgId, using regex.

0 Karma
1 Solution

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)

View solution in original post

0 Karma

sundareshr
Legend

Since there's no element called myMsgId, I assume you want the messageId element extracted into a field called myMsgId

\<messageId\>(?<myMsgId>[^\<]+)
0 Karma

nidhiagrawal
Explorer

Thanks, and you are right I was trying to extract in myMsgId.

I looked at my data again and there is a minor issue. There is a request xml and response xml. Response xml has both elements <messageId> and <refToMessageId>. Request xml only has <messageId>. So the regex is capturing the messageId element, whereas I need to match it with <refToMessageId>. Can regex be modified to match it with refToMessageId, and if refToMessageId is not avaialble then match with messageId.

MessageId from request matches with refToMessageId from response. So I am trying to use these elements to evaluate response time.

("xyzRequest>" OR "xyzResponse>" ) "-fd9035a:151642200c0:-37c2" | stats earliest(_time) AS startTime, latest(_time) AS endTime | eval responseTime=endTime-startTime

0 Karma

sundareshr
Legend

This will extract from refToMessageId and get one value in a new field called msgId

\<refToMessageId\>(?<myRefMsgId>[^\<]+) | eval msgId=coalesce(myMsgId, myRefMsgId)

For what you are trying to do, have you looked at the transaction command. You could do something like

.. | transaction msdId startswith="xyzRequest" endswith="xyzResponse" | table msgId duration
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...