I am trying to take a REX command from a search and push it back into the config files. The REX command works great. I am looking to capture the numerical value between two AttackCoords XML tags in a multi-line XML event. Some help from the brain trust would be appreciated.
Props:
[dreamcrusher]
TRANSFORMS-TrashRow1 = TrashRow1
TRANSFORMS-TrashRow2 = TrashRow2
BREAK_ONLY_BEFORE = <Interceptor>
MUST_BREAK_AFTER = </Interceptor>
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = 1
REPORT-AttackCoords = AttackCoords
Transforms:
[AttackCoords]
SOURCE_KEY = _raw
REGEX = (?m)(?<AttackCoords_value>(?<=<AttackCoords>).*?(?=<\/AttackCoords))
Data:
<Interceptor>
<AttackCoords>-79.9004372420782,24.34561266497651</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>30</Infiltrators>
<Enforcer>Bonefish</Enforcer>
<ActionDate>2013-03-22</ActionDate>
<ActionTime>06:38:00</ActionTime>
<RecordNotes></RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords></LaunchCoords>
<AttackVessel>Go Fast</AttackVessel>
</Interceptor>
Try this (props.conf)
EXTRACT-AttackCoords = \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>
Try this (props.conf)
EXTRACT-AttackCoords = \<AttackCoords\>(?<AttackCoords_value>[^\<]+)\<\/AttackCoords\>