Dashboards & Visualizations

Why is Splunk query to extract string inside XML tag not working with spath command?

maximusdm
Communicator

I am using the following query:

index=itx "PAD =" | dedup BOC | spath output=Channel path=AsRunMessage.Header.Channel  | table BOC, channel

which results in events with big XML content .. I need to extract the string "ITX1546" from inside the tags.

Also, I need to create a table with distinct rows containing unique BOC values.

The Channel field is not being populated.

Here is the XML structure:

alt text

Any ideas? Thank you

0 Karma
1 Solution

maximusdm
Communicator

found my own answer.. .rex "]+>(?[^<]+)"

View solution in original post

0 Karma

maximusdm
Communicator

found my own answer.. .rex "]+>(?[^<]+)"

0 Karma

maximusdm
Communicator
rex "<Channel [^>]+>(?<Channel>[^<]+)"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...