All Apps and Add-ons

Qualys App for Splunk Enterprise: How to get rid of HTML tags in Qualys "Solution" field?

muralianup
Communicator

I am using the Qualys App for Splunk Enterprise and there's a lot of HTML tags in the Solution field.

Eg:
<P> , <A Href, <PRE>..etc.

Is there any way to get rid of these?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You can use sedcmd in props.conf or rex in search.

sedcmd-htmlaaa = "s/\<P\>//g"   #removes <P>
sedcmd-htmlaab = "s/\<\/P\>//g" #removes</P>

etc.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

You can use sedcmd in props.conf or rex in search.

sedcmd-htmlaaa = "s/\<P\>//g"   #removes <P>
sedcmd-htmlaab = "s/\<\/P\>//g" #removes</P>

etc.

muralianup
Communicator

If its only

&

, its fine. But there're lots of other HTML tags in the field. Are you telling me I may need to add separate SED for each & every HTML tags ?

0 Karma

jkat54
SplunkTrust
SplunkTrust

yes, welcome to data science... you would need a separate sedcmd for each html tag in my opinion.

But perhaps you can use a single regex to remove all markup...

http://lmgtfy.com/?q=regex+to+remove+all+html

The problem with a single sedcmd to remove all is that this:

 <h1>header</h1><div><font="red">body</font></div>

... will become this:

 headerbody

... or perhaps this if you're really good with regex you'll get smart and add special word/character or spaces: (underscores followed by space instead of original tags for example)

_ header_ _ _ body_ _   
0 Karma

muralianup
Communicator

Got it working. Used this SED in the search:

rex field=SOLUTION mode=sed "s/<[^>]*>//g"

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...