Splunk Search

How can I build a regex to extract xml field value?

praspai
Path Finder

I want to extract XML field value ItemType and ItemNo from following XML. How can I build the Regular expression?

<impl:RetailItemList>
    <impl:VoRetailItem>
      <impl:ItemType>PPT</impl:ItemType>
      <impl:ItemNo>123456</impl:ItemNo>
      <impl:VoClassUnitKey>
        <impl:ClassType>BU</impl:ClassType>
        <impl:ClassUnitType>ST</impl:ClassUnitType>
        <impl:ClassUnitCode>0001</impl:ClassUnitCode>
      </impl:VoClassUnitKey>
    </impl:VoRetailItem>
  </impl:RetailItemList>
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)

View solution in original post

0 Karma

niketn
Legend

@praspai try the spath command for traversing xml or json:

| makeresults 
| eval _raw="<impl:RetailItemList>
     <impl:VoRetailItem>
       <impl:ItemType>PPT</impl:ItemType>
       <impl:ItemNo>123456</impl:ItemNo>
       <impl:VoClassUnitKey>
         <impl:ClassType>BU</impl:ClassType>
         <impl:ClassUnitType>ST</impl:ClassUnitType>
         <impl:ClassUnitCode>0001</impl:ClassUnitCode>
       </impl:VoClassUnitKey>
     </impl:VoRetailItem>
   </impl:RetailItemList>"
| spath

Above extracts all the fields but you can traverse and extract specific nodes as per need as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

suryaconsultant
New Member

above code didn't work for me, can you pls help to understand what should be the issue

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try add this to your search

| rex ItemType>(?<ItemType>\w+)
| rex ItemNo>(?<ItemNo>\d+)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Before using regex, have you looked at the spath and xpath commands?

---
If this reply helps you, Karma would be appreciated.
0 Karma

praspai
Path Finder

I want to extract these values as fields and search will be based on it. I didn't find the way to define it while adding the data source. I looked into it but I thought I can use these commands only in search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...