How to use spath to strip HTML from Page Response?

_gkollias · ‎10-15-2014

Hi All,

I am having trouble stripping HTML from a response from sending eReceipts to customers via dashboard. Here is the HTML I am trying to strip to only show the message in a pretty human-readable format:

<BODY bgcolor=#dddddd> <TABLE bgcolor=#dddddd border=1> <TR> <TD valign="top"><B>message</B></TD> <TD>Ereceipt successfully sent out</TD> </TR> </TABLE> </BODY>

For testing, I used this search to strip the initial HTML of the response in the search app (it works):

| stats count
| eval ctgResponse=HTML ABOVE
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"

However, when sending an eReceipt to a customer, the dashboard still displays the HTML formatted response.

Here is the search behind the dashboard including the spath command (cgereceiptsresubmit is a custom command):

    <title>Your Re-Submit Results:</title>
                <searchString> <![CDATA[ 
|stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| spath input=ctgResponse output=responseMessage path="BODY.TABLE.TR.TD{2}"
| table resubmit_url,ctg_response, resubmit_error
| rename resubmit_url as "Re-Submit URL", ctg_response as "CTG Response", resubmit_error as "Re-Submit Error Message"
]]>
</searchString>

Any insight on a why this might not be working would be greatly appreciated..

Thanks in advance!

somesoni2 · ‎10-15-2014

Try this as your search

Answer Updated:

 |stats count as dummy_field| eval bp_context_id="$bp_context_id$"
| eval PID_OUT="$PID_OUT$"
| eval TPCode="$TPCode$"
| eval OrderNumber="$OrderNumber$"
| eval ShipmentNumber="$ShipmentNumber$"
| eval OrderLink="$OrderLink$"
| eval emailTo="$emailTo$"
| eval emailCC="$emailCC$"
| eval emailBcc="$emailBcc$"
| eval emailSubject="$emailSubject$"
| eval emailBody="$emailBody$"
| fields - dummy_field
| fillnull value=""
| cgereceiptsresubmit
| eval responseMessage=if(responseMessage=="",ctgResponse,responseMessage)
| rex field=responseMessage "\<TD\>(?<responseMessage>[^\<]+)"
| table resubmit_url,responseMessage, resubmit_error
| rename resubmit_url as "Re-Submit URL", responseMessage as "CTG Response", resubmit_error as "Re-Submit Error Message"

_gkollias · ‎10-15-2014

This didn't quite work. What I did was send a test email to my own email account, and the dashboard still sent the eReceipt, however the table is not displaying any message. Please view the screenshot:

http://screencast.com/t/CehgFRg7tr

Thanks a lot for your efforts! Please let me know if there is anything else you need from me to resolve this.

somesoni2 · ‎10-15-2014

What is the output you're expecting after stipping html content.

_gkollias · ‎10-15-2014

It will just be "Ereceipt successfully sent out". Please view this screen shot:

http://screencast.com/t/vXfMwsQmgM

somesoni2 · ‎10-15-2014

Try this instead of spath command

| rex field=ctgResponse "\<TD\>(?<ctgResponse>[^\<]+)"

_gkollias · ‎10-15-2014

Thanks, but I am still getting the same result using ...| rex field=ctgResponse "(?[^<]+)"
...Not 100% sure what the issue is.

How to use spath to strip HTML from Page Response?

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life