Hi, first of all thanks for help me.
I have this log file:
2016-11-21T16:29:25.690+0100 INFO 2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
<![CDATA[
<CategoryAvailabilityRequest>
<SessionInfo>
<SessionID>value</SessionID>
<Profile>A</Profile>
<Language>DEU</Language>
<Version>1</Version>
</SessionInfo>
<BookingContext>
<AgencyID>value</AgencyID>
<BookingContactName>XML Test</BookingContactName>
<MarketCode>value</MarketCode>
<BookingCurrencyCode>value</BookingCurrencyCode>
<LanguageCode>value</LanguageCode>
<OfficeCode>DEU</OfficeCode>
</BookingContext>
<CruiseComponent>
<ComponentID>value</ComponentID>
<PromotionCode>didu20198212</PromotionCode>
I need to create the field OfficeCode then take the value to create a dashboard.
Splunk in automatic way do not recognize this field, could you help me to create a regular expression?
Thanks
Massimiliano
... View more