Splunk Search

extract multiple events into multiple fields using rex

i2sheri
Communicator

I have events in below format from an XML source. I want to extract below values in to separate events into fields status, start and end

I tried

...| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)#"

but no luck

PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS#20150921 10:00:14.562 20150921 10:00:14.570 20150921 10:00:14.577 20150921 10:00:14.584 20150921 10:00:14.591 20150921 10:00:14.599 20150921 10:00:14.606 20150921 10:00:14.611 20150921 10:00:14.631 20150921 10:00:14.641 20150921 10:00:14.650 20150921 10:00:14.687 20150921 10:00:14.705 20150921 10:00:14.734 20150921 10:00:14.747#20150921 10:00:14.568 20150921 10:00:14.574 20150921 10:00:14.582 20150921 10:00:14.588 20150921 10:00:14.596 20150921 10:00:14.604 20150921 10:00:14.609 20150921 10:00:14.627 20150921 10:00:14.639 20150921 10:00:14.648 20150921 10:00:14.684 20150921 10:00:14.703 20150921 10:00:14.716 20150921 10:00:14.745 20150921 10:00:14.750
Tags (3)
0 Karma
1 Solution

i2sheri
Communicator

It works with

| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)"

Just removed the # at end
and removed

| xmlkv

from base search

View solution in original post

0 Karma

i2sheri
Communicator

It works with

| table temp | mvexpand temp | rex field=temp "(?<status>.*)#(?<start>.*)#(?<end>.*)"

Just removed the # at end
and removed

| xmlkv

from base search

0 Karma

badrinath_itrs
Communicator

Can you please paste your original xml for better understanding.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...