Getting Data In

Need help with indexing xml file.

the_wolverine
Champion

I have XML in the following format that just refuses to break where I want it to --

<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">domain.com/My DL's/National Sales</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">domain.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:03 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv258AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>
  <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">
    <Property Name="PSComputerName" Type="System.String">name.domain.com\x
00</Property>
    <Property Name="RunspaceId" Type="System.Guid">a9f50fb3-0099-4d21-9aa5-94ca475bdf29</Property>
    <Property Name="ObjectModified" Type="System.String">server.com/My DL's/Self Service/Engineering Communications</Property>
    <Property Name="CmdletName" Type="System.String">Set-DistributionGroup</Property>
    <Property Name="CmdletParameters" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogCmdletParameter]">
      <Property Type="Microsoft.Exchange.Data.AdminAuditLogCmdletParameter">Identity</Property>
    </Property>
    <Property Name="ModifiedProperties" Type="Microsoft.Exchange.Data.MultiValuedProperty`1[Microsoft.Exchange.Data.AdminAuditLogModifiedProperty]" />
    <Property Name="Caller" Type="System.String">name.com/MyAdmins/My IFS/Teddybear</Property>
    <Property Name="Succeeded" Type="System.Boolean">True</Property>
    <Property Name="Error" Type="System.String">None</Property>
    <Property Name="RunDate" Type="System.DateTime">2/21/2012 4:37:02 PM</Property>
    <Property Name="OriginatingServer" Type="System.String">name (14.01.0355.001)</Property>
    <Property Name="Identity" Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEventId">RgAAAABZuIMBsz9hQYkmHmoLVD/eBwAM6z4YqiUIR4tO45EQAXW1AAAQbMZ5AABtjri4d2KwT5AmW72j0ns8AAAiv257AAAJ</Property>
    <Property Name="IsValid" Type="System.Boolean">True</Property>
  </Object>

My props.conf:

[my_xml]
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = False
MAX_TIMESTAMP_LOOKAHEAD = 500
TIME_PREFIX = (?m)\s* Type="System.DateTime">
LINE_BREAKER = </Object>(\s*)<Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent">

Ayn
Legend

I don't see a tag called <Object Type="Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent"> in your sample data? Either it's just omitted in the sample or it's the cause of why the LINE_BREAKER won't apply.

kristian_kolb
Ultra Champion

Perhaps you've misplaced it on the line above. I don't think TIME_PREFIX require a multiline specification.
/k

0 Karma

Ayn
Legend

I'm not entirely sure whether the \s you're matching on will match newlines as well by default. Might want to try putting a (?ms) at the start of the regex.

0 Karma

the_wolverine
Champion

Sorry I just updated the sample with the correct one. I'm using various samples to get this to work.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...