Splunk Search

multiline match for same pattern

tven
Explorer
<Product>
 <ProductName>(\w+)</ProductName>
 <ProductName>(\w+)</ProductName>
 <ProductName>(\w+)</ProductName>
</Product>

How do i capture all the product name when the number of ProductName elements is variable? And not sure how to assign the group capture to a named variable when you have 0 or more ProductNames.

index=xyz sourcetype=abc |rex "(?s)<ProductName>(?P<product_sku>\w+)</ProductName>" captures one occurence.

0 Karma

kristian_kolb
Ultra Champion

Have you looked at MV_ADD=true in order to get more than the last value?

Basically, you need to do the following changes/additions on your search head, or on your indexer if you don't have a dedicated search head;

in props.conf

[your_xml_sourcetype]
REPORT-gimme_codes = prod_code_extraction

in transforms.conf

[prod_code_extraction]
REGEX = <ProductName>([^<]+)<
FORMAT = product_sku::$1
MV_ADD = True

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...