Hello, I'm trying to show this event as a table: 2021-05-04 11:28:56.722, TIME="2021-05-04 11:28:56.722", ID="0a7a270b79341ba28179372363920a5d", CREATED="1620127736722", SOURCE="Group Aggregation", ACTION="entitlement_attribute_change", TARGET="CN=g-cvi_admin_test,OU=CVI,OU=Security,OU=Control Groups,DC=base,DC=dev", APPLICATION="AD Base Direct", ACCOUNT_NAME="memberOf", INSTANCE="003608aa42a7425793ea73cc7f9f8e65", ATTRIBUTE_NAME="msDS-PrincipalName", ATTRIBUTE_VALUE="BASEDEV\g-cvi_admin_test", ATTRIBUTES="<Attributes>
<Map>
<entry key="attributeName" value="msDS-PrincipalName"/>
<entry key="newValue" value="BASEDEV\g-cvi_admin_test"/>
<entry key="oldValue" value="BASEINT\g-cvi_admin_test"/>
</Map>
</Attributes>
", STRING1="Change of group of value CN=g-cvi_admin_test,OU=CVI,OU=Security,OU=Control Groups,DC=base,DC=dev on AD Base Direct", STRING2="BASEINT\g-cvi_admin_test", STRING3="group" I have all the fields extracted correctly even the ATTRIBUTES: <Attributes>
<Map>
<entry key="attributeName" value="msDS-PrincipalName"/>
<entry key="newValue" value="BASEDEV\g-cvi_admin_test"/>
<entry key="oldValue" value="BASEINT\g-cvi_admin_test"/>
</Map>
</Attributes> From this ATTRIBUTE field, thanks to: |rex max_match=0 field=ATTRIBUTES "<entry key=\"(?<key_xml>[a-zA-Z0-9_]+?)\" value=\"(?<value_xml>[\s\S]+?)(?:\"\/>)" From that I'm getting key_xml and value_xml as multivalues. I would like to have key_xml as column names and value_xml as row cells of the corresponding keys. Thanks to whomever can help me
... View more