I have an interesting problem. I have an xml which has a certain number of key value pairs which I need to extract it.
<record> <from>customerservice</from> <customer>Dan</customer> <heading>Reminder</heading> <body>Payment Overdue.Amount=176.Discount=16.Pay=160</body> </record>
I need to extract the following key value pairs
And turn them into a following table
customer | Amount | Amount | Pay ------------------------------ Dan | 176 | 16 | 160
How can I do it ?
Appreciate your help.
I don't know of anything to help you, other than what @gkanapathy suggested. You can always setup what he suggested in your props.conf and transforms.conf. This should automatically extract any values that are preceded by an "=" sign as a value of the field before the "=" sign for the sourcetype you specify.
Thanks for the quick response. I am already doing xmlkv and extracting the XML values for me.
I can see rex command will be usefull. But i am looking for a generic rule which will extract every thing in "body" automatically.