Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Need help with indexing xml file.

the_wolverine
Champion
‎03-13-2012 09:34 PM

I have XML in the following format that just refuses to break where I want it to -- 

<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>
  <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>

My props.conf:

[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
Reply

Ayn
Legend
‎03-13-2012 11:22 PM

I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent"> in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER won't apply.

Reply

kristian_kolb
Ultra Champion
‎03-26-2012 11:08 PM

Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k

0 Karma
Reply

Ayn
Legend
‎03-15-2012 12:30 AM

I'm not entirely sure whether the \s you're matching on will match newlines as well by default. Might want to try putting a (?ms) at the start of the regex.

0 Karma
Reply

the_wolverine
Champion
‎03-14-2012 09:28 AM

Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.

0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...