Hi, first of all thanks for help me.
I have this log file:
2016-11-21T16:29:25.690+0100 INFO 2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
<![CDATA[
<CategoryAvailabilityRequest>
<SessionInfo>
<SessionID>value</SessionID>
<Profile>A</Profile>
<Language>DEU</Language>
<Version>1</Version>
</SessionInfo>
<BookingContext>
<AgencyID>value</AgencyID>
<BookingContactName>XML Test</BookingContactName>
<MarketCode>value</MarketCode>
<BookingCurrencyCode>value</BookingCurrencyCode>
<LanguageCode>value</LanguageCode>
<OfficeCode>DEU</OfficeCode>
</BookingContext>
<CruiseComponent>
<ComponentID>value</ComponentID>
<PromotionCode>didu20198212</PromotionCode>
I need to create the field OfficeCode then take the value to create a dashboard.
Splunk in automatic way do not recognize this field, could you help me to create a regular expression?
Thanks
Massimiliano
The one given by @sundareshr should work fine if office code has \w
worth of data, however if there are more than \w
type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]
:
... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode
The one given by @sundareshr should work fine if office code has \w
worth of data, however if there are more than \w
type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]
:
... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode
Thank you both the expression works well!
Try this
... | rex "OfficeCode\>(?<office_code>\w+)\<" |...