rex extraction xsd tag

[indeed_2000]

Hi what is the rex for "No is invalid. Please ask to a admin"

Here is the log:

21:32:26.729 customer modules: type="xsd:string">&lt;response&gt;&lt;result&gt;ActionFail&lt;/result&gt;&lt;errno&gt;00000&lt;/errno&gt;&lt;desc&gt;No is invalid. Please ask to a admin&lt;/desc&gt;&lt;jobid&gt;000000&lt;/jobid&gt;&lt;msgid&gt;00000&lt;/msgid&gt;&lt;cmd&gt;info&lt;/cmd&gt;&lt;/response&gt;</return></ad1:

Thanks,

[gcusello · Accepted solution]

Hi @indeed_2000,

sorry but I don't understand what you realy want:

if you want to search the string, you don't need the regex and you can use the Splunk search;

If you want to use the regex command to search the string, you can use the command

| regex "No is invalid. Please ask to a admin"

Your log seems to be a Json log, so you could use the "spath" command

if you want to extract the "desc" field (that  in this case is  "No is invalid. Please ask to a admin"), you could use the rex command:

| rex "\<desc\>(?<desc>[^\<]+)\<\/desc\>"

or the rex command

| rex "\&lt;desc\&gt;(?<desc>[^\<]+)\&lt;\/desc\&gt;"

Let me know.

Ciao.

Giuseppe

[indeed_2000]

second rex work perfectly.

thanks