how can I do field substitution

[gbiju]

I have a multi value field as ns=n1,n2,n3 and n1,n2,n3 are also fields by themselves like
n1=abc, n2=pqr, n3=xyz

Using field ns, i need to somehow retrieve/display abc,pqr,xyz. Any solutions?

[martin_mueller]

Are you looking for something like this?

| stats count | eval _raw = "<SOAP-ENV:Body><ns1:getCustInfo xmlns:ns1=\"http://provider.company.com/getCustInfo_v3\"></SOAP-ENV:Body>"
| rex "\<(?<ns>[^:]+):getCustInfo" | eval custInfoNs = replace(_raw, "^.*?xmlns:".ns."=\"([^\"]+).*$", "\1")

That'll create a field called custInfoNs that will contain http://provider.company.com/getCustInfo_v3.

The issue is that rex doesn't allow the use of existing fields when building the regular expression, so the detour through replace() is needed.

[martin_mueller]

That sounds a lot like one of the quantifiers in the regex being too greedy. Do you have a short enough example to post here that still fails?

[gbiju]

Thanks Martin for the answer. It works perfectly in this isolated case scenario. But when I try it against a larger real world soap xml, where there are lot of namespaces, it doesnt work. I get the full xml in the field.

[gbiju]

i want to extract the namespace value of a soap message call.
Eg:

<SOAP-ENV:Body><ns1:getCustInfo xmlns:ns1=http://provider.company.com/getCustInfo_v3>
</SOAP-ENV:Body>

Since the same call comes from different clients, the ns1 is not fixed. In some messages, it will be ns5, ns14 etc mapping to the same namespace so the message is valid. I am able to put a rex to get the value prefixed before getCustInfo into a field ns, but using that I need to get 'http://provider.company.com/getCustInfo_v3'

[martin_mueller]

Please describe the actual use case rather than a proposed solution to an unknown use case.

Maybe there's a much simpler way to achieve the same goal.