I was having trouble with this search in my XML, I could not save it using the below search inside my searchString
tags.
index=core ... | rex ".*,.*Process type=(?P<ProcessType>[^,]+)"
And I know it is something to do with this
Or writing it another way
<ProcessType>
The trick was to write it as this:
index=core ... | rex ".*,.*Process type=(?P<ProcessType>[^,]+)"
that is use
<
instead of <
>
instead of >
Hope this helps others
Yeah, but what you're really looking for is the
It's the XML Escape. Then you don't need no pesky replacements.
<![CDATA[
stuff to escape <; &#^$(@#$
]]>
Check it:
<search>
<query>
<![CDATA[
index=core ... | rex ".*,.*Process type=(?P<ProcessType>[^,]+)"
]]>
</query>
<earliest>-2y</earliest>
<latest>-1y</latest>
</search>
tks for that, very helpful.
The trick was to write it as this:
index=core ... | rex ".*,.*Process type=(?P<ProcessType>[^,]+)"
that is use
<
instead of <
>
instead of >
Hope this helps others