Why am I getting a "extracting multiple fields" error when try to extract fields on a log file that contains XML?

[bradleycruicksh]

Hi,

I am trying to do a field extraction on a log file that contains XML as below however when I try to extract the "LAR..." section I am getting the following error in the GUI:
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.

Example of the log section below:

        <id>
          <domain>Id</domain>
          <id>LAR000000000000000000001</id>
        </id>

Can you tell me if this is possible?

Thanks

[cpetterborg]

What is the regex for extracting the data that is causing the error? I'm assuming this is from the Field Extraction Tool.
And is the XML data much larger and you are getting more fields than the one above? More information is helpful. 🙂

[bradleycruicksh]

Hi, thanks for the response.

I am using the GUI to extract the data and that's where I see the error. Once the error occurs the GUI stops me going any further and I have to remove the extraction.

Hope this helps

Best Regards
Bradley

[Sukisen1981]

Hi,

At most times it is best to write your own regex than use the GUI, extract more fields or build a regex from event actions. Coming back to your XMl , I suspect like @cpetterborg is saying , that your XML does indeed contain more fields than just the one LAR field