Splunk ITSI

Write Regex to capture words between containers?

logankinman99
Path Finder

I am a regex noob, and I was curious if there is a simple way to capture anything between containers.
For example,

<*Message>This is what I want to capture.<*/Message>

(Note: Please ignore the asterisks around Message...I had to use them as an escape character to make the containers appear.)

0 Karma
1 Solution

arjunpkishore5
Motivator

This should do the trick

| rex "Message\>(?<message>[^\<]+)\<"

View solution in original post

arjunpkishore5
Motivator

This should do the trick

| rex "Message\>(?<message>[^\<]+)\<"

logankinman99
Path Finder

Thank you! This worked perfectly

0 Karma

wenthold
Communicator

If you're looking to do this with in-line searching, you'll want to use the rex command to extract text with regex. If you're looking to do field extraction, you'll need to read up on props.conf and transforms.conf

Here is an in-line extraction example, using your message as a test value:

| makeresults
| eval message="<*Message>This is what I want to capture.<*/Message>"
| rex field=message ">(?<message_value>[^\<]+)<"

Regex101 is a great site for testing regular expression:

https://regex101.com/r/ihEPfj/1

Regex is far too deep a subject to really cover in a Splunk answers post, but there's a number of good sites that will provide some basic information, including a Splunk page ( Splunk and Regular Expressions ) but when I really wanted to dig in to regex I picked up "Mastering Regular Expressions" by Jeffrey Friedl and it definitely helped.

kiamco
Path Finder

this should do the trick

e\>(?<msg>[a-zA-Z .]+)<\/M

Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...