Replace parts of a string

[hbazan]

Hi! I'm trying to replace parts of a string, in order to make it more human-readable. Our logs contains strings like this one:

<properties><property><key>Prop1</key><value>1</value></property><property><key>Prop2</key><value>3</value></property><property><key>Prop3</key><value>2</value></property></properties>

And I want to show it like:

Prop1 = 1 | Prop2 = 3 | Prop3 = 2

I've extracted the inner part using:

rex "\<properties>(?<Properties>.*)\</properties>" 

And for the values I've tried using replace, but it won't let me replace the inner part of the string. I'm trying with makemv, but I can't get what I want. Is this possible?

[sideview]

One simple and low-tech way is to use eval's 'replace' function.

its not the prettiest but it might not make your head hurt as much as using rex in 'sed' mode. 😃

after your rex:

| rex "\<properties>(?<Properties>.*)\</properties>" |

put this:

| eval Properties=replace(Properties, "</key><value>", " = ") | eval Properties=replace(Properties, "</value></property><property><key>", " | ") | eval Properties=replace(Properties, "<property><key>", "") | eval Properties=replace(Properties, "</value></property>", "")

and while we're considering nutty solutions, here's another one. Again tack this onto the end of your rex where you're extracting the Properties string.

| eval Properties=replace(Properties, "<property>", "") | makemv Properties delim="</property>" | mvexpand Properties | rename Properties as _raw | xmlkv

that last one actually makes multivalued field and then splits them into their own rows... mileage/applicability may vary.

[dwaddle · Accepted solution]

You should be able to do this with rex's sed mode, similar to this:

| rex mode=sed "s#(<properties>)*<property><key>([^<]*)</key><value>([^<]*)</value></property>(</properties>)*#\2 = \3 #g"

This should also be usable as a "SEDCMD" in your props.conf file to edit the incoming data on the fly as it comes into splunk.

[hbazan]

Great! thanks dwaddle, I owe you a beer!