Dashboards & Visualizations

Separating XML events by tag

smcdonald20
Path Finder

Hi,

I need to ensure that each event breaks after the tag in my XML source.
How can i do this?

I've tried updating the props.conf file with the below, but it doesn't seem to be working.

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
MUST_BREAK_AFTER = "^<\/GPO>$"

0 Karma

somesoni2
Revered Legend

Do you want to keep everything between, including these tags, as one event?

<GPO>...stuffs</\/GPO>

If yes, give this a try
Updated per last comment

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
SHOULD_LINEMERGE =false
LINE_BREAKER = ([\r\n]+)(?=\s*\<GPO\s+xmlns)
0 Karma

sbbadri
Motivator

can you post sample data

try this,

MUST_BREAK_AFTER = <\/GPO>

0 Karma

niketn
Legend

@smcdonald20, can you add mocked up sample data for this as well?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

smcdonald20
Path Finder

Yes.

Please see below.

The events begin with this line: {noformat} {noformat}

And ends with <\GPO>

 {noformat}
 false
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>0</VersionDirectory>
<VersionSysvol>0</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>
<ExtensionData>
  <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
    <q1:Policy>
      <q1:Name>All Removable Storage classes: Deny all access</q1:Name>
      <q1:State>Disabled</q1:State>
      <q1:Explain>Configure access to all removable storage classes.
This policy setting takes precedence over any individual removable storage policy settings. To manage 
individual classes, use the policy settings available for each class.
If you enable this policy setting, no access is allowed to any removable storage class.
If you disable or do not configure this policy setting, write and read accesses are allowed to all 
removable storage classes.
      <q1:Supported>At least Windows Vista</q1:Supported>
      <q1:Category>System/Removable Storage Access</q1:Category>
    </q1:Policy>
  </Extension>
  <Name>Registry</Name>
</ExtensionData>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/PIPE/phillimore.com/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>




<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{C2606FE1-FAD1-4431-A512-D5B7C9F3923A}</Identifier>
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">options-it.com</Domain>

WBT Users
true
2017-09-19T11:25:22
2017-09-19T11:25:22
2017-09-19T12:48:31.4658229Z

<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1060284298-1275210071-1417001333-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(AU;CIIDSA;CCDCSWWPDTLOCRSDWDWO;;;WD)(AU;CIIDFA;CCDCSWWPDTCRSDWDWO;;;WD)</SDDL>
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Owner>
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Group>
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <InheritsFromParent>false</InheritsFromParent>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-519</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Enterprise Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/Hosting/webbtraders.nl/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>


{noformat}
0 Karma

smcdonald20
Path Finder

Sorry, the above is not formatting well 😞

The start of each event begins with this,

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">

The end of each event will end with this

</gpo>
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...