title: Using Splunk - extract fields from xml data in a log file using xpath
body: <p>I am using Splunk to extract a number of fields from xml data this is contained in a log file.  So to limit the search to be MOSTLY the xml file I start the search with this: 
   sourcetype="name of type here" "RULE" </p>
  
  <p>This returns:</p>
  
  <pre><code>0123459 TripMessage.createMessage MsgSource &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;tmsTrip xmlns="http://ground.fedex.com/schemas/linehaul/trip" xmlns:ns2="http://ground.fedex.com/schemas/linehaul/TMSCommon"&gt;
  </code></pre>
  
  <p>...</p>
  
  <p>The file is very large.  This is part of it.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;tmsTrip xmlns="http://ground.fedex.com/schemas/linehaul/trip" xmlns:ns2="http://ground.fedex.com/schemas/linehaul/TMSCommon"&gt;
     &lt;recordType&gt;PURCHASEDLINEHAUL&lt;/recordType&gt;
     &lt;eventType&gt;APPROVE&lt;/eventType&gt;
     &lt;tripId&gt;116029927&lt;/tripId&gt;
     &lt;legId&gt;104257037&lt;/legId&gt;
     &lt;tripNumber&gt;104257037&lt;/tripNumber&gt;
     &lt;tripLegNumber&gt;1&lt;/tripLegNumber&gt;
     &lt;updatedDateGMT&gt;2020-02-20T21:53:39.000Z&lt;/updatedDateGMT&gt;
  .... more lines here that are not important
       &lt;purchasedCost&gt;
        &lt;purchasedCostTripSegment&gt;
           &lt;purchCostReference&gt;1587040&lt;/purchCostReference&gt;
           &lt;carrier&gt;FXTR&lt;/carrier&gt;
           &lt;vendorType&gt;DRAY&lt;/vendorType&gt;
           &lt;billingMethod&gt;RULE&lt;/billingMethod&gt;
           &lt;carrierTrailerType&gt;PZ1&lt;/carrierTrailerType&gt;
           &lt;origin&gt;
              &lt;ns2:numberCode&gt;923&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;RLTO&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;330 RESOURCE DRIVE&lt;/ns2:address1&gt;
              &lt;ns2:address2&gt;LH PHONE 877-851-3543&lt;/ns2:address2&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/origin&gt;
  </code></pre>
  
  <p>This query selects the xml part text in the logging file and some of the fields are extracted and I can add to a table. (not including the source and sourcetype..)</p>
  
  <pre><code>| xmlkv | table purchCostReference, eventType, carrier, billingMethod
  </code></pre>
  
  <p>But need more fields that are child elements within the xml data. One of them is the <strong>numberCode</strong>. I am trying to use <strong>xpath</strong> to extract these additional fields.  </p>
  
  <pre><code>| xmlkv | xpath
  "//tmsTrip/purchasedCost/purchasedCostTripSegment/origin/ns2:numberCode" outfield=Origin | table purchCostReference, eventType, carrier, billingMethod, Origin
  </code></pre>
  
  <p>But no Origin data is returned when I add the field to the table.  There is no error.  The Origin column is empty.
  <a href="https://i.stack.imgur.com/h7Ika.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/h7Ika.png" alt="enter image description here"></a></p>
  
  <p><strong>UPDATE</strong>
  I think the problem is that I need to add the <strong>field</strong> parameter.  The xml file is within a log text file.  I limit the search to get the xml file but not only the xml.  So I think xpath is struggling with the other text that is not xml.</p>
  
  <p><strong>UPDATE</strong>
  I tried creating an extracted field using the wizard of the xml file that is within the logging statement.  The xml is huge and I can only select about 30% of it.  If anyone is good at regex, maybe they can give me some pointers as to how to complete the regex command to get all of the xml.  (I tried updating the props.conf file but do not have permission to add TRUNCATE = 0).
  This is the xml file sample:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;tmsTrip xmlns="http://ground.fedex.com/schemas/linehaul/trip" xmlns:ns2="http://ground.fedex.com/schemas/linehaul/TMSCommon"&gt;
     &lt;recordType&gt;PURCHASEDLINEHAUL&lt;/recordType&gt;
     &lt;eventType&gt;APPROVE&lt;/eventType&gt;
     &lt;tripId&gt;143642990&lt;/tripId&gt;
     &lt;legId&gt;129014817&lt;/legId&gt;
     &lt;tripNumber&gt;129014817&lt;/tripNumber&gt;
     &lt;tripLegNumber&gt;1&lt;/tripLegNumber&gt;
     &lt;updatedDateGMT&gt;2020-05-22T00:53:21.000Z&lt;/updatedDateGMT&gt;
     &lt;origin&gt;
        &lt;ns2:numberCode&gt;928&lt;/ns2:numberCode&gt;
        &lt;ns2:locAbbr&gt;ANAH&lt;/ns2:locAbbr&gt;
        &lt;ns2:address1&gt;590 E ORANGE THORPE AVENUE&lt;/ns2:address1&gt;
        &lt;ns2:city&gt;ANAHEIM&lt;/ns2:city&gt;
        &lt;ns2:stateProvince&gt;CA&lt;/ns2:stateProvince&gt;
        &lt;ns2:postalCode&gt;92801&lt;/ns2:postalCode&gt;
        &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
        &lt;ns2:numberType&gt;1&lt;/ns2:numberType&gt;
        &lt;ns2:timeZoneAbbr&gt;PST&lt;/ns2:timeZoneAbbr&gt;
        &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
     &lt;/origin&gt;
     &lt;destination&gt;
        &lt;ns2:numberCode&gt;89&lt;/ns2:numberCode&gt;
        &lt;ns2:locAbbr&gt;WOOD&lt;/ns2:locAbbr&gt;
        &lt;ns2:address1&gt;6000 RIVERSIDE DR&lt;/ns2:address1&gt;
        &lt;ns2:address2&gt;LH PHONE 732-512-5579&lt;/ns2:address2&gt;
        &lt;ns2:city&gt;KEASBEY&lt;/ns2:city&gt;
        &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
        &lt;ns2:postalCode&gt;08832&lt;/ns2:postalCode&gt;
        &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
        &lt;ns2:numberType&gt;2&lt;/ns2:numberType&gt;
        &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
        &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
     &lt;/destination&gt;
     &lt;schedDispatchDateGMT&gt;2020-05-22T13:00:00.000Z&lt;/schedDispatchDateGMT&gt;
     &lt;estimatedArrivalDateGMT&gt;2020-05-26T06:00:00.000Z&lt;/estimatedArrivalDateGMT&gt;
     &lt;drop/&gt;
     &lt;hook/&gt;
     &lt;actualRoute&gt;
        &lt;routeNumber&gt;308229&lt;/routeNumber&gt;
        &lt;routeOrderNumber&gt;0&lt;/routeOrderNumber&gt;
        &lt;totalMiles&gt;2787&lt;/totalMiles&gt;
        &lt;runTime&gt;54.6&lt;/runTime&gt;
     &lt;/actualRoute&gt;
     &lt;standardRoute&gt;
        &lt;routeNumber&gt;308229&lt;/routeNumber&gt;
        &lt;routeOrderNumber&gt;0&lt;/routeOrderNumber&gt;
        &lt;totalMiles&gt;2787&lt;/totalMiles&gt;
        &lt;runTime&gt;54.6&lt;/runTime&gt;
     &lt;/standardRoute&gt;
     &lt;paidRoute&gt;
        &lt;routeNumber&gt;308229&lt;/routeNumber&gt;
        &lt;routeOrderNumber&gt;0&lt;/routeOrderNumber&gt;
        &lt;totalMiles&gt;2787&lt;/totalMiles&gt;
        &lt;runTime&gt;54.6&lt;/runTime&gt;
     &lt;/paidRoute&gt;
     &lt;settlement&gt;
        &lt;dispatchSettlementEligibility&gt;false&lt;/dispatchSettlementEligibility&gt;
     &lt;/settlement&gt;
     &lt;livePkgCount&gt;0.0&lt;/livePkgCount&gt;
     &lt;tripTollAmount&gt;0.0&lt;/tripTollAmount&gt;
     &lt;trailers&gt;
        &lt;ns2:trailer&gt;
           &lt;ns2:trailerNbr&gt;531823&lt;/ns2:trailerNbr&gt;
           &lt;ns2:trailerPrefix&gt;FDXU&lt;/ns2:trailerPrefix&gt;
           &lt;ns2:configOrderNbr&gt;1&lt;/ns2:configOrderNbr&gt;
           &lt;ns2:sealNbr&gt;60606220&lt;/ns2:sealNbr&gt;
           &lt;ns2:packageWeight&gt;9931.59&lt;/ns2:packageWeight&gt;
           &lt;ns2:unladenWeight&gt;13870.0&lt;/ns2:unladenWeight&gt;
           &lt;ns2:totalWeight&gt;23801.59&lt;/ns2:totalWeight&gt;
           &lt;ns2:packageNumber&gt;703&lt;/ns2:packageNumber&gt;
           &lt;ns2:percentCube&gt;1&lt;/ns2:percentCube&gt;
           &lt;ns2:hazmatFlag&gt;false&lt;/ns2:hazmatFlag&gt;
           &lt;ns2:originPlanned&gt;
              &lt;ns2:numberCode&gt;928&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;ANAH&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;590 E ORANGE THORPE AVENUE&lt;/ns2:address1&gt;
              &lt;ns2:city&gt;ANAHEIM&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;CA&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;92801&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;1&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;PST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/ns2:originPlanned&gt;
           &lt;ns2:nextSortLocation&gt;
              &lt;ns2:numberCode&gt;89&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;WOOD&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;6000 RIVERSIDE DR&lt;/ns2:address1&gt;
              &lt;ns2:address2&gt;LH PHONE 732-512-5579&lt;/ns2:address2&gt;
              &lt;ns2:city&gt;KEASBEY&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;08832&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;2&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/ns2:nextSortLocation&gt;
           &lt;ns2:destinationPlanned&gt;
              &lt;ns2:numberCode&gt;89&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;WOOD&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;6000 RIVERSIDE DR&lt;/ns2:address1&gt;
              &lt;ns2:address2&gt;LH PHONE 732-512-5579&lt;/ns2:address2&gt;
              &lt;ns2:city&gt;KEASBEY&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;08832&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;2&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/ns2:destinationPlanned&gt;
           &lt;ns2:loads&gt;
              &lt;ns2:load&gt;
                 &lt;ns2:loadId&gt;103718801&lt;/ns2:loadId&gt;
                 &lt;ns2:loadNumber&gt;1&lt;/ns2:loadNumber&gt;
                 &lt;ns2:origin&gt;
                    &lt;ns2:numberCode&gt;928&lt;/ns2:numberCode&gt;
                    &lt;ns2:locAbbr&gt;ANAH&lt;/ns2:locAbbr&gt;
                    &lt;ns2:numberType&gt;1&lt;/ns2:numberType&gt;
                 &lt;/ns2:origin&gt;
                 &lt;ns2:destination&gt;
                    &lt;ns2:numberCode&gt;89&lt;/ns2:numberCode&gt;
                    &lt;ns2:locAbbr&gt;WOOD&lt;/ns2:locAbbr&gt;
                    &lt;ns2:address2&gt;LH PHONE 732-512-5579&lt;/ns2:address2&gt;
                    &lt;ns2:numberType&gt;2&lt;/ns2:numberType&gt;
                 &lt;/ns2:destination&gt;
                 &lt;ns2:openDateGMT&gt;2020-05-21T19:53:46.000Z&lt;/ns2:openDateGMT&gt;
                 &lt;ns2:dueOverrideFlag&gt;false&lt;/ns2:dueOverrideFlag&gt;
                 &lt;ns2:hazmatFlag&gt;false&lt;/ns2:hazmatFlag&gt;
              &lt;/ns2:load&gt;
           &lt;/ns2:loads&gt;
        &lt;/ns2:trailer&gt;
     &lt;/trailers&gt;
     &lt;dollys/&gt;
     &lt;purchasedCost&gt;
        &lt;purchasedCostTripSegment&gt;
           &lt;purchCostReference&gt;2625998&lt;/purchCostReference&gt;
           &lt;carrier&gt;BNSF&lt;/carrier&gt;
           &lt;vendorType&gt;RAIL&lt;/vendorType&gt;
           &lt;carrierTrailerType&gt;53PC&lt;/carrierTrailerType&gt;
           &lt;origin&gt;
              &lt;ns2:numberCode&gt;4022&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;BNSF&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;3770 EAST WASHINGTON AVENUE&lt;/ns2:address1&gt;
              &lt;ns2:city&gt;LOS ANGELES&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;CA&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;90040&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;8&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;PST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/origin&gt;
           &lt;destination&gt;
              &lt;ns2:numberCode&gt;4040&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;CROX&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;NORFOLK SOUTHERN RAILROAD&lt;/ns2:address1&gt;
              &lt;ns2:address2&gt;125 COUNTY ROAD&lt;/ns2:address2&gt;
              &lt;ns2:city&gt;CROXTON&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;07307&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;8&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/destination&gt;
           &lt;stopOff&gt;
              &lt;ns2:stopOffLocation&gt;
                 &lt;ns2:numberCode&gt;9996&lt;/ns2:numberCode&gt;
                 &lt;ns2:stateProvince&gt;DU&lt;/ns2:stateProvince&gt;
                 &lt;ns2:postalCode&gt;00000&lt;/ns2:postalCode&gt;
                 &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
                 &lt;ns2:numberType&gt;1&lt;/ns2:numberType&gt;
              &lt;/ns2:stopOffLocation&gt;
           &lt;/stopOff&gt;
           &lt;schedDispatchDate&gt;2020-05-22T05:00:00.000Z&lt;/schedDispatchDate&gt;
           &lt;estimatedArrivalDate&gt;2020-05-26T00:59:00.000Z&lt;/estimatedArrivalDate&gt;
           &lt;billingMethod&gt;RULE&lt;/billingMethod&gt;
           &lt;STCCCode&gt;4711110&lt;/STCCCode&gt;
           &lt;planNumber&gt;065&lt;/planNumber&gt;
           &lt;powerType&gt;1X&lt;/powerType&gt;
           &lt;powerOnlyFlag&gt;false&lt;/powerOnlyFlag&gt;
        &lt;/purchasedCostTripSegment&gt;
        &lt;purchasedCostTripSegment&gt;
           &lt;purchCostReference&gt;2625998&lt;/purchCostReference&gt;
           &lt;carrier&gt;NS&lt;/carrier&gt;
           &lt;vendorType&gt;RAIL&lt;/vendorType&gt;
           &lt;carrierTrailerType&gt;53PC&lt;/carrierTrailerType&gt;
           &lt;origin&gt;
              &lt;ns2:numberCode&gt;4061&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;NSAU&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;6300 SOUTH INDIANA AVENUE&lt;/ns2:address1&gt;
              &lt;ns2:city&gt;CHICAGO&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;IL&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;60637&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;8&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;CST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/origin&gt;
           &lt;destination&gt;
              &lt;ns2:numberCode&gt;4040&lt;/ns2:numberCode&gt;
              &lt;ns2:locAbbr&gt;CROX&lt;/ns2:locAbbr&gt;
              &lt;ns2:address1&gt;NORFOLK SOUTHERN RAILROAD&lt;/ns2:address1&gt;
              &lt;ns2:address2&gt;125 COUNTY ROAD&lt;/ns2:address2&gt;
              &lt;ns2:city&gt;CROXTON&lt;/ns2:city&gt;
              &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
              &lt;ns2:postalCode&gt;07307&lt;/ns2:postalCode&gt;
              &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
              &lt;ns2:numberType&gt;8&lt;/ns2:numberType&gt;
              &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
              &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
           &lt;/destination&gt;
           &lt;stopOff&gt;
              &lt;ns2:stopOffLocation&gt;
                 &lt;ns2:numberCode&gt;4040&lt;/ns2:numberCode&gt;
                 &lt;ns2:locAbbr&gt;CROX&lt;/ns2:locAbbr&gt;
                 &lt;ns2:address1&gt;NORFOLK SOUTHERN RAILROAD&lt;/ns2:address1&gt;
                 &lt;ns2:address2&gt;125 COUNTY ROAD&lt;/ns2:address2&gt;
                 &lt;ns2:city&gt;CROXTON&lt;/ns2:city&gt;
                 &lt;ns2:stateProvince&gt;NJ&lt;/ns2:stateProvince&gt;
                 &lt;ns2:postalCode&gt;07307&lt;/ns2:postalCode&gt;
                 &lt;ns2:locType&gt;FDEG&lt;/ns2:locType&gt;
                 &lt;ns2:numberType&gt;8&lt;/ns2:numberType&gt;
                 &lt;ns2:timeZoneAbbr&gt;EST&lt;/ns2:timeZoneAbbr&gt;
                 &lt;ns2:daylightSavingsFlag&gt;true&lt;/ns2:daylightSavingsFlag&gt;
              &lt;/ns2:stopOffLocation&gt;
           &lt;/stopOff&gt;
           &lt;schedDispatchDate&gt;2020-05-22T05:00:00.000Z&lt;/schedDispatchDate&gt;
           &lt;estimatedArrivalDate&gt;2020-05-26T01:00:00.000Z&lt;/estimatedArrivalDate&gt;
           &lt;billingMethod&gt;LOCAL&lt;/billingMethod&gt;
           &lt;STCCCode&gt;4711110&lt;/STCCCode&gt;
           &lt;planNumber&gt;045&lt;/planNumber&gt;
           &lt;powerType&gt;1X&lt;/powerType&gt;
           &lt;powerOnlyFlag&gt;false&lt;/powerOnlyFlag&gt;
        &lt;/purchasedCostTripSegment&gt;
     &lt;/purchasedCost&gt;
     &lt;drivers/&gt;
  &lt;/tmsTrip&gt;
  </code></pre>
  
  <p>This is how much the extracted field I can select:
  
  http://ground.fedex.com/schemas/linehaul/trip\" xmlns:ns2=\"<a href="http://ground.fedex.com/schemas/linehaul/TMSCommon%5C" rel="nofollow noreferrer">http://ground.fedex.com/schemas/linehaul/TMSCommon\</a>">
     PURCHASEDLINEHAUL
     APPROVE
     143642990
     129014817
     129014817
     1
     2020-05-22T00:53:21.000Z
     
        928
        ANAH
        590 E ORANGE THORPE AVENUE
        ANAHEIM
        CA
        92801
        FDEG
        1
        PST
        true</p>
  
  <p>This is the regex that Splunk creates to select the above xml</p>
  
  <pre><code>^[^\$\n]*\$\d+\.\w+\s+\w+\s+(?P&lt;xmlMessage&gt;&lt;\?\w+\s+\w+="\d+\.\d+"\s+\w+="\w+\-\d+"\?&gt;\s+&lt;\w+\s+\w+="\w+://\w+\.\w+\.\w+/\w+/\w+/\w+"\s+\w+:\w+="\w+://\w+\.\w+\.\w+/\w+/\w+/\w+"&gt;\s+&lt;\w+&gt;\w+&lt;/\w+&gt;\s+&lt;\w+&gt;\w+&lt;/\w+&gt;\s+&lt;\w+&gt;\d+&lt;/\w+&gt;\s+&lt;\w+&gt;\d+&lt;/\w+&gt;\s+&lt;\w+&gt;\d+&lt;/\w+&gt;\s+&lt;\w+&gt;\d+&lt;/\w+&gt;\s+&lt;\w+&gt;\d+\-\d+\-\d+\w+:\d+:\d+\.\d+\w+&lt;/\w+&gt;\s+&lt;\w+&gt;\s+&lt;\w+:\w+&gt;\d+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\d+\s+\w+\s+\w+\s+\w+\s+\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\d+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\d+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;\s+&lt;\w+:\w+&gt;\w+&lt;/\w+:\w+&gt;)
  </code></pre>
  
  <p>So can I change the above regex to include the entire xml?</p>
  
  <p><strong>UPDATE</strong>
  I tried extracting a field from the xmlMessage extracted field.  The xmlMessage field is above. I used the <strong>xpath</strong> command to extract <strong>recordType</strong>.  Put the result in a table. This is the command</p>
  
  <pre><code>| xmlkv | xpath field=xmlMessage
  "//tmsTrip/recordType" outfield=Origin | table Origin
  </code></pre>
  
  <p>It returned no results.  This xpath command does not work for the simplest of queries.
  What am I doing wrong?</p>