Splunk Search

How to extract a string from a particular XML tags with regular expression?

kirangurram
Explorer

Dear Experts ,
Need your help with regular expression. I have an XML tag in the field f.
I would like to extract all the characters including spaces (or) Special characters from this XML string <Rmk>.
I tried to use search | rex field=f "\<Rmk\>"(?<Rmk>\w*)"\<\/Rmk\>" , however this regular expression is not giving any output.

your help is much appreciated with this query.

XML Tag :

<Rmk>ABC*/ Work Direct---</Rmk>

Desired Output : ABC*/ Work Direct---

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

View solution in original post

woodcock
Esteemed Legend

Just add ... | spath input=f, like this:

|makeresults | eval f="<Rmk>ABC*/ Work Direct---</Rmk>"

| spath input=f
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi kirangurram,
if you're satisfied of this solution, please accept and/or upvote it.
See next time.
Bye.
Giuseppe

0 Karma

DavidHourani
Super Champion

didn't see you commented there Giuseppe 🙂 deleting my answer 🙂

0 Karma

kirangurram
Explorer

thanks for your help @gcusello . Your solution works.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...