I have this string..
<a:StatusMessage i:nil="true"></a:StatusMessage>
I have millions of these strings which do not have anything between the 2 tags.. Now there are maybe a hundred of those strings that have something between those two tag,s but I don't remember what it was. How can I write a search to exclude all results that have nothing between the 2 tags and include results that have something between the tags?
Example:
I'm looking for something like this where it says EXCEPTION
<a:StatusMessage i:nil="true">EXCEPTION</a:StatusMessage>
Let's approach it this way. We'll do a field extraction and then handle it in SPL.
sourcetype=mysourcetype StatusMessage
| rex "<a:StatusMessage[^>]+>(?<status_message_string>[^<]*)</a:StatusMessage>"
| search status_message_string=*
Using the rex
command we make a field extraction for "what appears between the tags, if anything" and name it status_message_string
. From there, we can search for any time it has a value.
Let's approach it this way. We'll do a field extraction and then handle it in SPL.
sourcetype=mysourcetype StatusMessage
| rex "<a:StatusMessage[^>]+>(?<status_message_string>[^<]*)</a:StatusMessage>"
| search status_message_string=*
Using the rex
command we make a field extraction for "what appears between the tags, if anything" and name it status_message_string
. From there, we can search for any time it has a value.