Help with Field Extraction from raw data

[yuvasree]

Below is the sample input for my search

BusinessIdentifier : 09 ***** MessageIdentifier : 3308b7dd-826c-4e98-8511-6a018c5f8bcc ***** TimeStamp : 2022-03-16T11:08:30.013Z ***** ElapsedTime : 0.25 ***** InterfaceName : NLTOnline ***** ServiceLayerName : OSB ***** ServiceLayerOperation : CreateQPBillingEvents ***** ServiceLayerPipeline : requestPipeline ***** SiteID : ***** DomainName : ***** ServerName : DEVserver ***** FusionErrorCode : ***** FusionErrorMessage : ***** <Body xmlns="http://schemas.xmlsoap.org/soap/envelope/"><com:createQPBillEvents xmlns:com="com.alcatel.lucent.on.ws.manager"> <com:ACTION_DATE>2021-08-30T23:59:59+08:00</com:ACTION_DATE> <com:ADR_BLDG_TYPE>HDB</com:ADR_BLDG_TYPE>

=============

I need to extract the values of the below 

ElapsedTime : 0.25 

 InterfaceName : NLTOnline

ServiceLayerName : OSB 

 ServiceLayerOperation : CreateQPBillingEvents

 ServiceLayerPipeline : requestPipeline 

Using xmlkv its not working. can someone help to provide the right command?

[richgalloway · Accepted solution]

xmlkv doesn't work because the event is not well-formed XML so it's rex to the rescue!  🙂

| rex "ElapsedTime : (?<ElapsedTime>\S+)"
| rex "InterfaceName : (?<InterfaceName>\S+)"
| rex "ServiceLayerName : (?<ServiceLayerName>\S+)"
| rex "ServiceLayerOperation : (?<ServiceLayerOperation>\S+)"
| rex "ServiceLayerPipeline : (?<ServiceLayerPipeline>\S+)"

 If it weren't for the spaces around the colons, the extract command might have worked, but that's why we have rex.