xml like log

[cboillot]

I have a log that I am trying to parse and I am unable to figure this out. It looks like a type of XML file. Here is an example:

<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
  <RequestInformation
     Hostname='1.2.3.4' 
     HostAddress='5.6.7.8'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
     ReferringPage=''
     RequestType='POST'
     ContentLength='505'
     RawUrl='/dir/subdir/filename.asmx'>
    <Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='ORA-01017: invalid username/password; logon denied'>
    <StackTrace>
      <![CDATA[
   at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
   at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
   at Oracle.DataAccess.Client.OracleConnection.Open()
   at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>

I have the Add-on for Oracle database installed, but it don't seem to work with this one.

[dindu · Accepted solution]

Hi,

You could try something like below during the search time by using the spath command
Please rename the fields and use table command to display the fields better,

     |makeresults
     |eval _raw="<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
        <RequestInformation
           Hostname='1.2.3.4' 
           HostAddress='5.6.7.8'
           HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
           ReferringPage=''
           RequestType='POST'
           ContentLength='505'
           RawUrl='/dir/subdir/filename.asmx'>
          <Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
          <Cookies>
          </Cookies>
          <Form>
          </Form>
        </RequestInformation>
        <Exception Message='ORA-01017: invalid username/password; logon denied'>
          <StackTrace>
            <![CDATA[
         at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
         at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
         at Oracle.DataAccess.Client.OracleConnection.Open()
         at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
      ]]>
          </StackTrace>
        </Exception>
      </ErrorMessage>"
      |spath input=_raw

You could also add KV_MODE = xml in the props.conf and breaking the lines appropriately

      KV_MODE = xml

[cboillot]

I have tried the KV_MODE = xml and it didn't seem to do anything.

[dindu]

Set the linebreaker in props.conf as

     LINE_BREAKER = </ErrorMessage>

[cboillot]

Now I am seeing results with tick marks, like this

'ASP.NET_SessionId'

[cboillot]

looks like this might have been what was needed. thanks.