Splunk Search

rex extraction xsd tag

indeed_2000
Builder

Hi what is the rex for "No is invalid. Please ask to a admin"

Here is the log:

21:32:26.729 customer modules: type="xsd:string">&lt;response&gt;&lt;result&gt;ActionFail&lt;/result&gt;&lt;errno&gt;00000&lt;/errno&gt;&lt;desc&gt;No is invalid. Please ask to a admin&lt;/desc&gt;&lt;jobid&gt;000000&lt;/jobid&gt;&lt;msgid&gt;00000&lt;/msgid&gt;&lt;cmd&gt;info&lt;/cmd&gt;&lt;/response&gt;</return></ad1:

Thanks,

Labels (4)
0 Karma
1 Solution

gcusello
Legend

Hi @indeed_2000,

sorry but I don't understand what you realy want:

if you want to search the string, you don't need the regex and you can use the Splunk search;

If you want to use the regex command to search the string, you can use the command

| regex "No is invalid. Please ask to a admin"

Your log seems to be a Json log, so you could use the "spath" command

if you want to extract the "desc" field (that  in this case is  "No is invalid. Please ask to a admin"), you could use the rex command:

| rex "\<desc\>(?<desc>[^\<]+)\<\/desc\>"

or the rex command

| rex "\&lt;desc\&gt;(?<desc>[^\<]+)\&lt;\/desc\&gt;"

Let me know.

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @indeed_2000,

sorry but I don't understand what you realy want:

if you want to search the string, you don't need the regex and you can use the Splunk search;

If you want to use the regex command to search the string, you can use the command

| regex "No is invalid. Please ask to a admin"

Your log seems to be a Json log, so you could use the "spath" command

if you want to extract the "desc" field (that  in this case is  "No is invalid. Please ask to a admin"), you could use the rex command:

| rex "\<desc\>(?<desc>[^\<]+)\<\/desc\>"

or the rex command

| rex "\&lt;desc\&gt;(?<desc>[^\<]+)\&lt;\/desc\&gt;"

Let me know.

Ciao.

Giuseppe

View solution in original post

indeed_2000
Builder

second rex work perfectly.

thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!