Dashboards & Visualizations

Separating XML events by tag

smcdonald20
Path Finder

Hi,

I need to ensure that each event breaks after the tag in my XML source.
How can i do this?

I've tried updating the props.conf file with the below, but it doesn't seem to be working.

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
MUST_BREAK_AFTER = "^<\/GPO>$"

0 Karma

somesoni2
Revered Legend

Do you want to keep everything between, including these tags, as one event?

<GPO>...stuffs</\/GPO>

If yes, give this a try
Updated per last comment

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
SHOULD_LINEMERGE =false
LINE_BREAKER = ([\r\n]+)(?=\s*\<GPO\s+xmlns)
0 Karma

sbbadri
Motivator

can you post sample data

try this,

MUST_BREAK_AFTER = <\/GPO>

0 Karma

niketn
Legend

@smcdonald20, can you add mocked up sample data for this as well?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

smcdonald20
Path Finder

Yes.

Please see below.

The events begin with this line: {noformat} {noformat}

And ends with <\GPO>

 {noformat}
 false
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>0</VersionDirectory>
<VersionSysvol>0</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>
<ExtensionData>
  <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
    <q1:Policy>
      <q1:Name>All Removable Storage classes: Deny all access</q1:Name>
      <q1:State>Disabled</q1:State>
      <q1:Explain>Configure access to all removable storage classes.
This policy setting takes precedence over any individual removable storage policy settings. To manage 
individual classes, use the policy settings available for each class.
If you enable this policy setting, no access is allowed to any removable storage class.
If you disable or do not configure this policy setting, write and read accesses are allowed to all 
removable storage classes.
      <q1:Supported>At least Windows Vista</q1:Supported>
      <q1:Category>System/Removable Storage Access</q1:Category>
    </q1:Policy>
  </Extension>
  <Name>Registry</Name>
</ExtensionData>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/PIPE/phillimore.com/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>




<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{C2606FE1-FAD1-4431-A512-D5B7C9F3923A}</Identifier>
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">options-it.com</Domain>

WBT Users
true
2017-09-19T11:25:22
2017-09-19T11:25:22
2017-09-19T12:48:31.4658229Z

<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1060284298-1275210071-1417001333-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(AU;CIIDSA;CCDCSWWPDTLOCRSDWDWO;;;WD)(AU;CIIDFA;CCDCSWWPDTCRSDWDWO;;;WD)</SDDL>
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Owner>
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Group>
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <InheritsFromParent>false</InheritsFromParent>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-519</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Enterprise Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/Hosting/webbtraders.nl/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>


{noformat}
0 Karma

smcdonald20
Path Finder

Sorry, the above is not formatting well 😞

The start of each event begins with this,

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">

The end of each event will end with this

</gpo>
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...