Dashboards & Visualizations

Unable to extract XML for a search - advice sought.

mikefapex
Explorer

If you have a minute to help, I am trying to search on the: to/ContactURI within the XML found in this result. I have tried several things but it is not working the way I expect/need. This is what I have tried, each without success. No errors, just no results. Thanks for looking

-- No results, no errors
eventtype=dmz_event | rex "(?.*)" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "(?.)" | xmlkv dmz_xml_text outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="*3036561711"

eventtype=dmz_event | rex "(?.*)" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "(?.*)" | spath input=dmz_xml_text output=to_contact path="//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

===Sample data


3:52:49.238 PM 2013-06-03 15:52:49,238 [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' INFO SEND_MESSAGE_REQ_LOG [] - *Server in-bound request
GET 209.211.75.102:80/AFTelephonyRWS/restful/PHN01/7209959443/call?token=f32226911935a741e7245cf3c1dcf3e7
CORRELATION ID : a556630f-46c9-49d4-aa95-70c6f1665383-MFID-AF_GetSummaryCallLogs_CCS
X-Forwarded-Server: ecomt113.qwest.com
X-Forwarded-For: 174.255.128.245
Accept: application/json
Cookie2: $Version=1
Host: 209.211.75.102
X-Cluster-Client-Ip: 155.70.21.27
Cookie: JSESSIONID=TdY4RtXd1dB8Qsj1JXQjbZkvnh2cvLKgBpLV5T6f2HGQh1ytwpcy!-1767480122
X-Forwarded-Host: ecomt113.qwest.com:50747
Connection: Keep-Alive
Max-Forwards: 10

<?xml version="1.0" encoding="UTF-8"?>

Hi, My name is SOA Runner. This is a soa automated test.


5038333065
TelURI

SOA Runner
Automated



3036561711
TelURI



Tags (1)
0 Karma
1 Solution

JSapienza
Contributor

At first look , you are not escaping your regex properly.

\< messagetext\>(?< dmz_xml_text >.*)\<\/messagetext\>

View solution in original post

0 Karma

mikefapex
Explorer

Hmmm, that would not surprise me, I'm Regex-dicapped. But trying this still yields no results.

eventtype=dmz_event | rex "< messagetext>(?.*)<\/messagetext>" | xpath outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="3036561711"

eventtype=dmz_event | rex "< messagetext>(?.)<\/messagetext>" | xmlkv dmz_xml_text outfield=to_contact "//messageLogType/to/contactURI/contact" | search to_contact="*3036561711"

0 Karma

JSapienza
Contributor

At first look , you are not escaping your regex properly.

\< messagetext\>(?< dmz_xml_text >.*)\<\/messagetext\>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...