I think I see the issue. The second part of the string is not terminated by a carriage return / new lines and looks to just continue on 13/07/17 23:07:44:186 EST] 00000040 SystemOut O 23:07:44.185 [WebContainer : 8] ERROR c.a.r.l.controller.NotifyController - OOps javax.xml.ws.soap.SOAPFaultException: Failed to process response headers at org.apache.axis2.jaxws.marshaller.impl.alt.MethodMarshallerUtils.createSystemException(MethodMarshallerUtils.java:1363) ~[org.apache.axis2.jar:na] at org.apache.axis2.jaxws.marshaller.impl.alt. This explains why I am getting the full output rather than stopping at the first 'at' ... View more

Still not working... I am now just getting the entire output that spans many lines when I really just want to get the first 3 (well the first 2 really as the first line wraps) [29/07/17 23:33:22:707 EST] 0000003e SystemOut O 23:33:22.707 [WebContainer : 4] ERROR c.a.r.l.controller.NotifyController - OOps javax.xml.ws.soap.SOAPFaultException: Failed to process response headers ... 31 lines omitted ... The regex I was using stops at the first return (after the word OOps. How do I get it to also include the second line and then stop at the end of line (javax.xml.ws.soap.SOAPFaultException: Failed to process response headers) ? The provide regex (and thank you for this) also picks up the 31 omitted lines. ... View more

Hello... Thanks for the advice.. I have tried the various options below but none allow me to progress past retrieving the first 2 lines [29/07/17 23:33:22:707 EST] 0000003e SystemOut O 23:33:22.707 [WebContainer : 4] ERROR c.a.r.l.controller.NotifyController - OOps The whole string I am trying to extract is [29/07/17 23:33:22:707 EST] 0000003e SystemOut O 23:33:22.707 [WebContainer : 4] ERROR c.a.r.l.controller.NotifyController - OOps javax.xml.ws.soap.SOAPFaultException: Failed to process response headers Regex I am using is rex field=_raw "(?ms)\[.*?(?P<ERR>[^\r\n]+)" I know I am missing something but just cannot figure out what. Cheers, Alastair ... View more

Both work a treat.. thank you so much for your help. Cheers, Alastair ... View more

Tried that.. the problem with the dedup is that it only returns the latest event and removes some of the events I am trying to included. Eg: If I do count of quotes for the current day I get 36. If I remove he duplicates I get 25. If I do the same for those quotes that have triggered a referral I end up with 17 (including duplicates) and 12 if I remove the duplicates. Using dedup and a count by processStatus gives me only 10 referrals. For any quote there can be multiple entries QN1- Referred QN1 - Completed QN1 - Closed QN2 - Completed QN2 - Closed Dedup returns QN1 - Closed (as this is the latest event). Is there a way to return a dc(Quotes) and a dc(Quotes) where status = Referred (eg using the above as a guide - 2 quotes and 1 referral) ... View more

I have managed to get part way there with where acc="Inc" AND Stage = "NewBusiness" | stats dc(quoteNumber) AS Quotes count(eval(processStatus="ManualRatingRequired")) as Referrals | eval perc=round(Referrals/Quotes*100, 1)."%" But the referrals are still being counted more than once. If I set count to dc for referrals then I , obviously, end up with only one event. ... View more

One other issue I am trying to figure out in relation to the above is that each quote number can repeat multiple times which in turn is producing skewed results. If I run a search with out the duplicates being removed I get a a total of 344 over a given time period with 69 referrals yet if I remove duplicates I end up with 101 unique events with 33 referrals over the same time period. This obviously returns very different % values. Is there away of amending the above to return a distinct count of the total number of quotes (duplicates removed) and then the distinct count of the referred quotes (again with duplicated removed). Cheers, Alastair ... View more

Perfect.. thank you so much ... View more

Found it .... adding %3D fixes the issue. ... View more

Hello, Thanks for the above but I have narrowed to the issue down to the '=' sign. For some reason this is getting stripped when the text is being passed across. If I remove the '=' sign then all works but the search returns the incorrect results. Is there a way of stopping the sign from being removed ? Cheers. ... View more

Perfect... thank you so much. I cannot say how much this has helped. Cheers Alastair ... View more

But that will also remove the duplicate stage of Endorsement (which I want to keep. In any policyNumber there should only ever be 1 NewBusiness, 1 Close but there can be multiple endorsements (I I need to keep these) ... View more

Thank you.. your suggestion makes good sense and I was never particuarly keen on have to hard set a number for the search results... However, the initial search has moved on a bit as I found the data was not giving me what i was after so now have a search with a whole lot of xpath commands (to get the data I need from the xml). index=aalalive "Policy Number allocated for Quote" | rex "O [^A-Z]*(?<ENV>[A-Z\-\d+\s]+) \[" | search ENV="PRD*" | eval PRODUCT=substr(Quote_Number, len(Quote_Number)-2,3) | search PRODUCT=COM | map search="search index=stps NEVO policyNumber=$Policy_Number$" maxsearches=10000 | xpath outfield=Net_Premium "//*[local-name()='AALNet' and *[local-name()='AnnualAmount']]/*[local-name()='EndOfTermAmount']" | xpath outfield=Net_Returned_Premium "//*[local-name()='AALNet' and *[local-name()='AnnualAmount']]/*[local-name()='ComparisonAmount']" | xpath outfield=Gross_Premium "//*[local-name()='Gross' and *[local-name()='FortnightlyAmount']]/*[local-name()='EndOfTermAmount']" | xpath outfield=Gross_Returned_Premium "//*[local-name()='Gross' and *[local-name()='FortnightlyAmount']]/*[local-name()='ComparisonAmount']" | xpath outfield=Stage "//*[local-name()='TransactionInformation']/*[local-name()='ContractStage']" | xpath outfield=Status "//*[local-name()='TransactionInformation']/*[local-name()='ContractStatus']" | xpath outfield=Account "//*[local-name()='OrganisationName' and *[local-name()='TypeCode']]/*[local-name()='FullName']" | where Status="Closed" | eval Gross_Premium=if(match(Gross_Returned_Premium , "0.00") , Gross_Premium , Gross_Returned_Premium) | eval Net_Premium=if(match(Net_Returned_Premium ,"0.00") , Net_Premium , Net_Returned_Premium) | fieldformat Gross_Premium = "$" + tostring(Gross_Premium, "commas") | fieldformat Net_Premium = "$" + tostring(Net_Premium, "commas") | table Account policyNumber Stage Status Gross_Premium Net_Premium I have tried to play around with your example above but cannot figure out where to insert the xpath commands so that the search returns results - each time I run it it simply returns 'No Results' Any pointers will be a great help.. A million thanks as always Alastair ... View more

A further update.. xpath outfield=test1 "//*[local-name()='OrganisationName' and *[local-name()='TypeCode']]/*[local-name()='FullName']" Gives me Allianz Test Account Terry Terry Now just to work out a way to get the first entry only ... View more

I feel like I am getting closer. The following does something (just not what I am expecting). If I understand it correctly the following finds the element 'Organisation' and then checks to see if the element also contains the words INTERMEDIARY_ORG_001 xpath outfield=test "//Organisation[@*[local-name() = 'INTERMEDIARY_ORG_001']/OrganisationName/FullName]" When I run the query I get the correct number of results but no output (ie just blank lines. ... View more

I cant I am sorry as it contains confidential information. The section of concern is as above and the text that I am trying to extract is contained in no other section that that above. For some reason the escaping XML is being removed.. will try to past again <_0:Organisation key="INTERMEDIARY_ORG_001"> <_0:MailingAddress addressReference="INTERMEDIARY_ADDRESS_001"/> <_0:OrganisationName> <_0:TypeCode>CommonName</_0:TypeCode> <_0:FullName>GARATY MURNANE - SME TRANSFER</_0:FullName> </_0:OrganisationName> </_0:Organisation> <_0:Organisation key="INSURED_ORG_001"> <_0:MailingAddress addressReference="INSURED_ADDRESS_001"/> <_0:AustralianTaxInformation> <_0:GSTRegistered>false</_0:GSTRegistered> </_0:AustralianTaxInformation> <_0:OrganisationName> <_0:TypeCode>CommonName</_0:TypeCode> <_0:FullName>CDA Investments Pty Ltd</_0:FullName> </_0:OrganisationName> <_0:OrganisationName> <_0:TypeCode>TradingName</_0:TypeCode> <_0:FullName>CDA Investments Pty Ltd</_0:FullName> </_0:OrganisationName> </_0:Organisation> I can use xpath with out issues to extract other sections of the xml it is just the above giving me grief as there is no unique key for each section. Cheers Alastair ... View more

Thank you so much 🙂 ... View more