Splunk Search

Why is the regex in transforms.conf not activating in the UI?

jpcontrerasadit
Explorer

I am trying to take a REX command from a search and push it back into the config files. The REX command works great. I am looking to capture the numerical value between two AttackCoords XML tags in a multi-line XML event. Some help from the brain trust would be appreciated.

Props:

[dreamcrusher]
TRANSFORMS-TrashRow1 = TrashRow1
TRANSFORMS-TrashRow2 = TrashRow2
BREAK_ONLY_BEFORE = <Interceptor>
MUST_BREAK_AFTER = </Interceptor>
DATETIME_CONFIG = 
NO_BINARY_CHECK = true
category = Custom
pulldown_type = 1
REPORT-AttackCoords = AttackCoords

Transforms:

[AttackCoords]
SOURCE_KEY = _raw
REGEX = (?m)(?<AttackCoords_value>(?<=<AttackCoords>).*?(?=<\/AttackCoords))

Data:

<Interceptor>
    <AttackCoords>-79.9004372420782,24.34561266497651</AttackCoords>
    <Outcome>Interdiction</Outcome>
    <Infiltrators>30</Infiltrators>
    <Enforcer>Bonefish</Enforcer>
    <ActionDate>2013-03-22</ActionDate>
    <ActionTime>06:38:00</ActionTime>
    <RecordNotes></RecordNotes>
    <NumEscaped>0</NumEscaped>
    <LaunchCoords></LaunchCoords>
    <AttackVessel>Go Fast</AttackVessel>
</Interceptor>
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>

View solution in original post

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...