Splunk Search

extract multiple events into multiple fields using rex

i2sheri
Communicator

I have events in below format from an XML source. I want to extract below values in to separate events into fields status, start and end

I tried

...| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)#"

but no luck

PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS#20150921 10:00:14.562 20150921 10:00:14.570 20150921 10:00:14.577 20150921 10:00:14.584 20150921 10:00:14.591 20150921 10:00:14.599 20150921 10:00:14.606 20150921 10:00:14.611 20150921 10:00:14.631 20150921 10:00:14.641 20150921 10:00:14.650 20150921 10:00:14.687 20150921 10:00:14.705 20150921 10:00:14.734 20150921 10:00:14.747#20150921 10:00:14.568 20150921 10:00:14.574 20150921 10:00:14.582 20150921 10:00:14.588 20150921 10:00:14.596 20150921 10:00:14.604 20150921 10:00:14.609 20150921 10:00:14.627 20150921 10:00:14.639 20150921 10:00:14.648 20150921 10:00:14.684 20150921 10:00:14.703 20150921 10:00:14.716 20150921 10:00:14.745 20150921 10:00:14.750
Tags (3)
0 Karma
1 Solution

i2sheri
Communicator

It works with

| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)"

Just removed the # at end
and removed

| xmlkv

from base search

View solution in original post

0 Karma

i2sheri
Communicator

It works with

| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)"

Just removed the # at end
and removed

| xmlkv

from base search

0 Karma

badrinath_itrs
Communicator

Can you please paste your original xml for better understanding.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...