Help with Field Extraction from raw data

yuvasree — Mon, 01 Aug 2022 19:46:49 GMT

Below is the sample input for my search

BusinessIdentifier : 09 ***** MessageIdentifier : 3308b7dd-826c-4e98-8511-6a018c5f8bcc ***** TimeStamp : 2022-03-16T11:08:30.013Z ***** ElapsedTime : 0.25 ***** InterfaceName : NLTOnline ***** ServiceLayerName : OSB ***** ServiceLayerOperation : CreateQPBillingEvents ***** ServiceLayerPipeline : requestPipeline ***** SiteID : ***** DomainName : ***** ServerName : DEVserver ***** FusionErrorCode : ***** FusionErrorMessage : ***** <Body xmlns="http://schemas.xmlsoap.org/soap/envelope/"><com:createQPBillEvents xmlns:com="com.alcatel.lucent.on.ws.manager"> <com:ACTION_DATE>2021-08-30T23:59:59+08:00</com:ACTION_DATE> <com:ADR_BLDG_TYPE>HDB</com:ADR_BLDG_TYPE>

=============

I need to extract the values of the below

ElapsedTime : 0.25

InterfaceName : NLTOnline

ServiceLayerName : OSB

ServiceLayerOperation : CreateQPBillingEvents

ServiceLayerPipeline : requestPipeline

Using xmlkv its not working. can someone help to provide the right command?

Re: Field Extraction from raw data

richgalloway — Mon, 01 Aug 2022 19:15:23 GMT

xmlkv doesn't work because the event is not well-formed XML so it's rex to the rescue! 🙂

| rex "ElapsedTime : (?<ElapsedTime>\S+)" | rex "InterfaceName : (?<InterfaceName>\S+)" | rex "ServiceLayerName : (?<ServiceLayerName>\S+)" | rex "ServiceLayerOperation : (?<ServiceLayerOperation>\S+)" | rex "ServiceLayerPipeline : (?<ServiceLayerPipeline>\S+)"

If it weren't for the spaces around the colons, the extract command might have worked, but that's why we have rex.

topic Help with Field Extraction from raw data in Getting Data In

Help with Field Extraction from raw data

Re: Field Extraction from raw data