Splunk Search

regex extracting between xml tags and quotes

exocore123
Path Finder
<fin:Data namespace=\"url1\" type=\"EData\">...

Using
basic search | rex "Data\snamespace=\"(?P<preName>[^\"]+)\"" | stats count by preName is empty

Error here
basic search | rex "Data\snamespace=\\\"(?P<preName>[^\\]+)\\\"" | stats count by preName

I am not sure what's wrong, no results found. I am trying to get url1 using the regex above, but it's not matching? I am trying to see the list of values for that particular tag

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

basic search | rex "Data\snamespace=[^\"]+\"(?P<preName>[^\"]+)\"" | stats count by preName

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need this:

| makeresults | eval _raw="...
...<fin:Data namespace=\\\"url1\\\" type=\\\"EData\\\">..."
| rex "Data\snamespace=\\\\\"(?<preName>[^\\\"]+)\\\\\""

somesoni2
Revered Legend

Try like this

basic search | rex "Data\snamespace=[^\"]+\"(?P<preName>[^\"]+)\"" | stats count by preName

View solution in original post

0 Karma

exocore123
Path Finder

Care to explain? I also still have "\" at the end, are we just matching until we see quotations?

0 Karma

somesoni2
Revered Legend

That's correct. after namespace= match till next double quotes (avoiding escaped backward slash altogether). Rest is same as your's.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!