Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Need help with indexing xml file.

the_wolverine
Champion
‎03-13-2012 09:34 PM

I have XML in the following format that just refuses to break where I want it to -- 

<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>
  <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>

My props.conf:

[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
Reply

Ayn
Legend
‎03-13-2012 11:22 PM

I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent"> in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER won't apply.

Reply

kristian_kolb
Ultra Champion
‎03-26-2012 11:08 PM

Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k

0 Karma
Reply

Ayn
Legend
‎03-15-2012 12:30 AM

I'm not entirely sure whether the \s you're matching on will match newlines as well by default. Might want to try putting a (?ms) at the start of the regex.

0 Karma
Reply

the_wolverine
Champion
‎03-14-2012 09:28 AM

Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.

0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...