Splunk Search

Why is the regex in transforms.conf not activating in the UI?

jpcontrerasadit
Explorer

I am trying to take a REX command from a search and push it back into the config files. The REX command works great. I am looking to capture the numerical value between two AttackCoords XML tags in a multi-line XML event. Some help from the brain trust would be appreciated.

Props:

[dreamcrusher]
TRANSFORMS-TrashRow1 = TrashRow1
TRANSFORMS-TrashRow2 = TrashRow2
BREAK_ONLY_BEFORE = <Interceptor>
MUST_BREAK_AFTER = </Interceptor>
DATETIME_CONFIG = 
NO_BINARY_CHECK = true
category = Custom
pulldown_type = 1
REPORT-AttackCoords = AttackCoords

Transforms:

[AttackCoords]
SOURCE_KEY = _raw
REGEX = (?m)(?<AttackCoords_value>(?<=<AttackCoords>).*?(?=<\/AttackCoords))

Data:

<Interceptor>
    <AttackCoords>-79.9004372420782,24.34561266497651</AttackCoords>
    <Outcome>Interdiction</Outcome>
    <Infiltrators>30</Infiltrators>
    <Enforcer>Bonefish</Enforcer>
    <ActionDate>2013-03-22</ActionDate>
    <ActionTime>06:38:00</ActionTime>
    <RecordNotes></RecordNotes>
    <NumEscaped>0</NumEscaped>
    <LaunchCoords></LaunchCoords>
    <AttackVessel>Go Fast</AttackVessel>
</Interceptor>
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>

View solution in original post

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...