Splunk Search

need help to remove xml tag with attribute

dmuley
Explorer
I have the event that looks like below 

 

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

and I would like to remove below xml element with attribute from data fields , How can I do that ?

<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

Results I want is 

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

Labels (1)
0 Karma

dmuley
Explorer

this is not first element (but specific element) always and since we dont have access to rops.conf need solution to get pure data while querying

@richgalloway  

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for clarifying the question.  Try adding this rex command to your query.

| rex mode=sed "s/\<InfoNox_Interface .+?\>//"

 

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Assuming it's always the first tag in the data field then this may help.  Put it in the appropriate props.conf stanza.

SEDCMD-remtag = s/data="<[^\>]+>/data="/
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...