my event records are xml based as shown below coming in from one file, one sourcetype- <transaction><id>12</id>........</transaction> <transaction>.....</transaction> // inside transaction tag i can contain anything <transaction>.....</transaction> <error>.....</error> <error>.....</error> <transaction>.....</transaction> <transaction>.....</transaction> <error>.....</error> I am able to extract child tags inside each one - thats not an issue. But how do i count how many records were of type Transaction and how many were of type Error.
↧