Dashboards & Visualizations

Parsing oddly formatted XML (NetApp log)

New Member

Hello, I'm trying to parse a XML file generated by NetApp security auditing. I'm able to get it ingested, but it's just a string, so it's hard for the consumers to decode. The XML itself is confusingly formatted, I'm baffled on how to parse. I wouldn't mind extracting the key/values and dumping the raw message.

My props is:

    category = Custom
    description = netapp
    disabled = false
    pulldown_type = true
    BREAK_ONLY_BEFORE = ^<Event>
    KV_MODE = xml
    TIME_PREFIX = TimeCreated SystemTime\=

The data looks like this(except all run together - no line breaks):

    <Provider Name="Netapp-Security-Auditing"/>
    <EventName>Open Object</EventName>
    <Result>Audit Success</Result>
    <TimeCreated SystemTime="2017-05-05T21:05:15.082531000Z"/>
   ##lines like below have variations on how they show the key=values
    <Data Name="SubjectIP" IPVersion="4"></Data>
    <Data Name="SubjectUnix" Uid="65534" Gid="65534" Local="false"></Data>
    <Data Name="SubjectUserSid">S-1-5-21-2112345321-1480738125-1508530778-84740</Data>
    <Data Name="SubjectUserIsLocal">false</Data>
    <Data Name="SubjectDomainName">theDomain</Data>
    <Data Name="SubjectUserName">Bob12345</Data>
    <Data Name="ObjectServer">Security</Data>
    <Data Name="ObjectType">File</Data>
    <Data Name="HandleID">00000000000424;00;00069642;b4221099</Data>
    <Data Name="ObjectName">(design);/Jobs/RR41_Video/RR41_PRINT/~mc_rr41~3.idlk</Data>
    <Data Name="AccessList">%%4423 %%1537 %%1541 </Data>
    <Data Name="AccessMask">11080</Data>
    <Data Name="DesiredAccess">Read Attributes; Delete; Synchronize; </Data>
    <Data Name="Attributes"></Data>


Tags (1)
0 Karma

New Member

Thanks, I'll try spath out next. I am able to get some meaningful data out with xmlkv & rex (below). xmlkv gets some of the fields and the rex grabs a few more.
My preference is to extract at index time so that I only store the fields I care about, but still researching - haven't figured that out yet.

index=netapp | xmlkv | search EventName="*"
|rex "\<Data Name\=\"ObjectName\"\>(?<file>.*?)\<\/Data\>"
| rex "\<Data Name\=\"OldPath\"\>(?<oldfile>.*?)\<\/Data\>" 
| rex "\<Data Name\=\"NewPath\"\>(?<newfile>.*?)\<\/Data\>" 
|table _time, EventName, file, oldfile, newfile
0 Karma


you can use the spath command after its been indexed
nice examples here in answers:
hope it helps

0 Karma