Splunk - field extraction

[chuck_life09]

I need to extract a value from this field and update in my table.

Details.Context = "dgfhgjj <Property Name="Name" VariantType="8">TRIMWorkgroup</Property>"

field_name               irrelevant data            when Name="Name" i want the result value (TRIMWorkgroup) in this case as my field value in new field name called "Service"

Help me with a rex command for this.

[gcusello · Accepted solution]

Hi @chuck_life09,

let me understand:

when you have Name="Name", you want the string between ">" and "<", if this is your need, please try this:

| rex field=Details.Context "Name\=\"Name\"[^\>]+\>(?<your_field>[^\<]+)"

you can test the regex at https://regex101.com/r/ainfns/1

Ciao.

Giuseppe

[chuck_life09]

thank you so much, it worked ...

[gcusello]

Hi @chuck_life09,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉