Getting Data In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results forย 
Search instead forย 
Did you mean:ย 
Ask a Question

Need help with indexing xml file.

the_wolverine
Champion
โ€Ž03-13-2012 09:34 PM

I have XML in the following format that just refuses to break where I want it to -- 

<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>
  <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>

My props.conf:

[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
Reply

Ayn
Legend
โ€Ž03-13-2012 11:22 PM

I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent"> in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER won't apply.

Reply

kristian_kolb
Ultra Champion
โ€Ž03-26-2012 11:08 PM

Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k

0 Karma
Reply

Ayn
Legend
โ€Ž03-15-2012 12:30 AM

I'm not entirely sure whether the \s you're matching on will match newlines as well by default. Might want to try putting a (?ms) at the start of the regex.

0 Karma
Reply

the_wolverine
Champion
โ€Ž03-14-2012 09:28 AM

Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.

0 Karma
Reply