How to search for text between 2 tags and exclude all results that have nothing?

[skoelpin]

I have this string..

<a:StatusMessage i:nil="true"></a:StatusMessage>

I have millions of these strings which do not have anything between the 2 tags.. Now there are maybe a hundred of those strings that have something between those two tag,s but I don't remember what it was. How can I write a search to exclude all results that have nothing between the 2 tags and include results that have something between the tags?

Example:

I'm looking for something like this where it says EXCEPTION

<a:StatusMessage i:nil="true">EXCEPTION</a:StatusMessage>

[dwaddle · Accepted solution]

Let's approach it this way. We'll do a field extraction and then handle it in SPL.

sourcetype=mysourcetype StatusMessage 
| rex "<a:StatusMessage[^>]+>(?<status_message_string>[^<]*)</a:StatusMessage>"
| search status_message_string=*

Using the rex command we make a field extraction for "what appears between the tags, if anything" and name it status_message_string. From there, we can search for any time it has a value.