Dashboards & Visualizations

Separating XML events by tag

smcdonald20
Path Finder

Hi,

I need to ensure that each event breaks after the tag in my XML source.
How can i do this?

I've tried updating the props.conf file with the below, but it doesn't seem to be working.

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
MUST_BREAK_AFTER = "^<\/GPO>$"

0 Karma

somesoni2
Revered Legend

Do you want to keep everything between, including these tags, as one event?

<GPO>...stuffs</\/GPO>

If yes, give this a try
Updated per last comment

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
SHOULD_LINEMERGE =false
LINE_BREAKER = ([\r\n]+)(?=\s*\<GPO\s+xmlns)
0 Karma

sbbadri
Motivator

can you post sample data

try this,

MUST_BREAK_AFTER = <\/GPO>

0 Karma

niketn
Legend

@smcdonald20, can you add mocked up sample data for this as well?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

smcdonald20
Path Finder

Yes.

Please see below.

The events begin with this line: {noformat} {noformat}

And ends with <\GPO>

 {noformat}
 false
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>0</VersionDirectory>
<VersionSysvol>0</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>
<ExtensionData>
  <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
    <q1:Policy>
      <q1:Name>All Removable Storage classes: Deny all access</q1:Name>
      <q1:State>Disabled</q1:State>
      <q1:Explain>Configure access to all removable storage classes.
This policy setting takes precedence over any individual removable storage policy settings. To manage 
individual classes, use the policy settings available for each class.
If you enable this policy setting, no access is allowed to any removable storage class.
If you disable or do not configure this policy setting, write and read accesses are allowed to all 
removable storage classes.
      <q1:Supported>At least Windows Vista</q1:Supported>
      <q1:Category>System/Removable Storage Access</q1:Category>
    </q1:Policy>
  </Extension>
  <Name>Registry</Name>
</ExtensionData>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/PIPE/phillimore.com/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>




<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{C2606FE1-FAD1-4431-A512-D5B7C9F3923A}</Identifier>
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">options-it.com</Domain>

WBT Users
true
2017-09-19T11:25:22
2017-09-19T11:25:22
2017-09-19T12:48:31.4658229Z

<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1060284298-1275210071-1417001333-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(AU;CIIDSA;CCDCSWWPDTLOCRSDWDWO;;;WD)(AU;CIIDFA;CCDCSWWPDTCRSDWDWO;;;WD)</SDDL>
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Owner>
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Group>
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <InheritsFromParent>false</InheritsFromParent>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-519</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Enterprise Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/Hosting/webbtraders.nl/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>


{noformat}
0 Karma

smcdonald20
Path Finder

Sorry, the above is not formatting well 😞

The start of each event begins with this,

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">

The end of each event will end with this

</gpo>
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...