Hi All,
I have a search which parses key/value pairs out of a strangely-formatted XML field.
rex field=xml "<N>(?<field_name>(.*?))</N><V>(?<field_value>(.*?))<" | eval {field_name}=field_value
Above, when there is a single match, this works as expected. I have the field name and the field value available as a field in my results. What I don't know how to do, is make this work for multiple matches. When I run:
rex field=xml max_match=0 "<N>(?<field_name>(.*?))</N><V>(?<field_value>(.*?))<" | eval {field_name}=field_value
Then both field_name and field_value are multi-value fields. I would like to make each key=value available in the results as I did above. Can anyone give me a pointer on how to accomplish this?
Thanks.
... View more