Splunk Search

How to extract an XML element attribute which has a space and no quotation marks?

wuwangjun
New Member

Hi Guys,

I have the below XML in a log file:

I can't get the the name attribute via "path="Customer{@value}")" patter. I also can't get the other elements after customer

Can anybody help me please?

BR

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

View solution in original post

0 Karma

ppablo
Retired

@wuwangjun

Please edit your question to include your XML code you meant to share. Click on the gear icon to the right of your question's title and click Edit. After you paste your XML, highlight all of that code and, as @jkat54 says, click on the Code Sample button in the text editing tools. This will ensure your XML renders properly on this site.

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the "code sample/blocks" button to put your xml code in blocks. Or use a site like pastebin.com if you still cant get the code to show up.

if you use the single leaning quote (below ~ tilda on my keyboard) it quotes the xml and html tags very well
<example>test</example>

richgalloway
SplunkTrust
SplunkTrust

Where is the "below xml"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...