Splunk Search

Why is the regex in transforms.conf not activating in the UI?

jpcontrerasadit
Explorer

I am trying to take a REX command from a search and push it back into the config files. The REX command works great. I am looking to capture the numerical value between two AttackCoords XML tags in a multi-line XML event. Some help from the brain trust would be appreciated.

Props:

[dreamcrusher]
TRANSFORMS-TrashRow1 = TrashRow1
TRANSFORMS-TrashRow2 = TrashRow2
BREAK_ONLY_BEFORE = <Interceptor>
MUST_BREAK_AFTER = </Interceptor>
DATETIME_CONFIG = 
NO_BINARY_CHECK = true
category = Custom
pulldown_type = 1
REPORT-AttackCoords = AttackCoords

Transforms:

[AttackCoords]
SOURCE_KEY = _raw
REGEX = (?m)(?<AttackCoords_value>(?<=<AttackCoords>).*?(?=<\/AttackCoords))

Data:

<Interceptor>
    <AttackCoords>-79.9004372420782,24.34561266497651</AttackCoords>
    <Outcome>Interdiction</Outcome>
    <Infiltrators>30</Infiltrators>
    <Enforcer>Bonefish</Enforcer>
    <ActionDate>2013-03-22</ActionDate>
    <ActionTime>06:38:00</ActionTime>
    <RecordNotes></RecordNotes>
    <NumEscaped>0</NumEscaped>
    <LaunchCoords></LaunchCoords>
    <AttackVessel>Go Fast</AttackVessel>
</Interceptor>
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>

View solution in original post

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...