Splunk Search

How to extract an XML element attribute which has a space and no quotation marks?

wuwangjun
New Member

Hi Guys,

I have the below XML in a log file:

I can't get the the name attribute via "path="Customer{@value}")" patter. I also can't get the other elements after customer

Can anybody help me please?

BR

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

View solution in original post

0 Karma

ppablo
Retired

@wuwangjun

Please edit your question to include your XML code you meant to share. Click on the gear icon to the right of your question's title and click Edit. After you paste your XML, highlight all of that code and, as @jkat54 says, click on the Code Sample button in the text editing tools. This will ensure your XML renders properly on this site.

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will extract the value from "path"

\"path=\"(\w+)

0 Karma

wuwangjun
New Member

Thank you , I have resolve it by the regular expression. Thank all of you.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the "code sample/blocks" button to put your xml code in blocks. Or use a site like pastebin.com if you still cant get the code to show up.

if you use the single leaning quote (below ~ tilda on my keyboard) it quotes the xml and html tags very well
<example>test</example>

richgalloway
SplunkTrust
SplunkTrust

Where is the "below xml"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...