How to create a regular expression for a field in a log file?

[mderosa]

Hi, first of all thanks for help me.

I have this log file:

2016-11-21T16:29:25.690+0100 INFO    2867 com.l7tech.log.custom.csm: -4: SplunkService=LIVEpolicy_csmws_poas
... 20 lines omitted ...
                  <![CDATA[
                     <CategoryAvailabilityRequest>
    <SessionInfo>
        <SessionID>value</SessionID>
        <Profile>A</Profile>
        <Language>DEU</Language>
        <Version>1</Version>
    </SessionInfo>
    <BookingContext>
        <AgencyID>value</AgencyID>
        <BookingContactName>XML Test</BookingContactName>
        <MarketCode>value</MarketCode>
        <BookingCurrencyCode>value</BookingCurrencyCode>
        <LanguageCode>value</LanguageCode>
        <OfficeCode>DEU</OfficeCode>
    </BookingContext>
    <CruiseComponent>
        <ComponentID>value</ComponentID>
        <PromotionCode>didu20198212</PromotionCode>

I need to create the field OfficeCode then take the value to create a dashboard.

Splunk in automatic way do not recognize this field, could you help me to create a regular expression?

Thanks
Massimiliano

[gokadroid · Accepted solution]

The one given by @sundareshr should work fine if office code has \w worth of data, however if there are more than \w type of data that can be part of officeCode then you can give this a try as well as \w only covers [a-zA-Z0-9_]:

... | rex "OfficeCode\>(?<OfficeCode>[^\<]+)\<" | table OfficeCode

[mderosa]

Thank you both the expression works well!

[sundareshr]

Try this

... | rex "OfficeCode\>(?<office_code>\w+)\<" |...