If you have a minute to help, I am trying to search on the: to/ContactURI within the XML found in this result. I have tried several things but it is not working the way I expect/need. This is what I have tried, each without success. No errors, just no results. Thanks for looking
-- No results, no errors
eventtype=dmz_event | rex "
eventtype=dmz_event | rex "
eventtype=dmz_event | rex "
eventtype=dmz_event | rex "
===Sample data
3:52:49.238 PM 2013-06-03 15:52:49,238 [ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' INFO SEND_MESSAGE_REQ_LOG [] - *Server in-bound request
GET 209.211.75.102:80/AFTelephonyRWS/restful/PHN01/7209959443/call?token=f32226911935a741e7245cf3c1dcf3e7
CORRELATION ID : a556630f-46c9-49d4-aa95-70c6f1665383-MFID-AF_GetSummaryCallLogs_CCS
X-Forwarded-Server: ecomt113.qwest.com
X-Forwarded-For: 174.255.128.245
Accept: application/json
Cookie2: $Version=1
Host: 209.211.75.102
X-Cluster-Client-Ip: 155.70.21.27
Cookie: JSESSIONID=TdY4RtXd1dB8Qsj1JXQjbZkvnh2cvLKgBpLV5T6f2HGQh1ytwpcy!-1767480122
X-Forwarded-Host: ecomt113.qwest.com:50747
Connection: Keep-Alive
Max-Forwards: 10
<?xml version="1.0" encoding="UTF-8"?>
Hi, My name is SOA Runner. This is a soa automated test.
5038333065
TelURI
SOA Runner
Automated
3036561711
TelURI
At first look , you are not escaping your regex properly.
\< messagetext\>(?< dmz_xml_text >.*)\<\/messagetext\>
Hmmm, that would not surprise me, I'm Regex-dicapped. But trying this still yields no results.
eventtype=dmz_event | rex "< messagetext>(?
eventtype=dmz_event | rex "< messagetext>(?
At first look , you are not escaping your regex properly.
\< messagetext\>(?< dmz_xml_text >.*)\<\/messagetext\>