Splunk Search

Why is the regex in transforms.conf not activating in the UI?

jpcontrerasadit
Explorer

I am trying to take a REX command from a search and push it back into the config files. The REX command works great. I am looking to capture the numerical value between two AttackCoords XML tags in a multi-line XML event. Some help from the brain trust would be appreciated.

Props:

[dreamcrusher]
TRANSFORMS-TrashRow1 = TrashRow1
TRANSFORMS-TrashRow2 = TrashRow2
BREAK_ONLY_BEFORE = <Interceptor>
MUST_BREAK_AFTER = </Interceptor>
DATETIME_CONFIG = 
NO_BINARY_CHECK = true
category = Custom
pulldown_type = 1
REPORT-AttackCoords = AttackCoords

Transforms:

[AttackCoords]
SOURCE_KEY = _raw
REGEX = (?m)(?<AttackCoords_value>(?<=<AttackCoords>).*?(?=<\/AttackCoords))

Data:

<Interceptor>
    <AttackCoords>-79.9004372420782,24.34561266497651</AttackCoords>
    <Outcome>Interdiction</Outcome>
    <Infiltrators>30</Infiltrators>
    <Enforcer>Bonefish</Enforcer>
    <ActionDate>2013-03-22</ActionDate>
    <ActionTime>06:38:00</ActionTime>
    <RecordNotes></RecordNotes>
    <NumEscaped>0</NumEscaped>
    <LaunchCoords></LaunchCoords>
    <AttackVessel>Go Fast</AttackVessel>
</Interceptor>
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>

View solution in original post

somesoni2
Revered Legend

Try this (props.conf)

EXTRACT-AttackCoords =  \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...