How do I get a value from a field as described in the following example?

[vaibhavvijay9]

some normal text.......and in between 

    <ns0:ExceptionLog_Action>

        <ns0:Exception>

         <ns0:Code>111</ns0:Code>

         <ns0:Reason>ErrorCode: Life-003&#xD;Reason: Mapping error in Web Service &#xD;Stacktrace...(other sub-fields)</ns0:Reason>


        </ns0:Exception>

    </ns0:ExceptionLog_Action>

I want the value of Reason: inside <ns0:Reason> before 
 that is : Mapping error in Web Service

Please help me to do so.

Thanks In Advance

Vaibhav Vijay

[whrg · Accepted solution]

Hello Vaibhav,

I can see that "Mapping error in Web Service" is prefixed by "Reason:"

With that in mind, check out this regex:

Reason: (?<Reason>[^&]+) &#xD

This is how you can verify:

| makeresults count=1
| eval _raw="some normal text.......and in between <ns0:ExceptionLog_Action> <ns0:Exception> <ns0:Code>111</ns0:Code> <ns0:Reason>ErrorCode: Life-003&#xD;Reason: Mapping error in Web Service &#xD;Stacktrace...(other sub-fields)</ns0:Reason> </ns0:Exception> </ns0:ExceptionLog_Action>"
| rex field=_raw "Reason: (?<Reason>[^&]+) &#xD"

[vaibhavvijay9]

Thanks a lot Whrg!!

I am really grateful for your help, it has been incredibly helpful to me.

Regards,
Vaibhav Vijay