Getting Data In

Parse Complex XML Node Name/Value

Nicolasfm
Engager

I have a log file which is written out in XML through Microsoft.Practices.EnterpriseLibrary.ExceptionHandling. I want to be able to get key elements out so I can report on the exception message.
Specifcally looking for

  • Exception/additionalInfo/info{MachineName}.value

I would like to create an extract field for it but really do not know where to start so I can search on the value or print the value directly, instead of Name showing with all the name values and then Values showing with all the value options based on the following parameters

  • Exception.additionalInfo.info{@name}
  • Exception.additionalInfo.info{@value}

Sample Log File

<Exception handlingInstanceId="d419e407-c5d0-4d57-a44d-baeea7948192">
  <Description>An exception of type 'System.ArgumentException' occurred and was caught.</Description>
  <DateTime>2015-07-03 09:24:16Z</DateTime>
  <ExceptionType>System.ArgumentException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
  <Message>Invalid message, exception trying to get file interchange delimiters.</Message>
  <Source>Utility.Converter</Source>
  <HelpLink />
  <Property name="ParamName"><undefined value></Property>
  <Property name="Data">System.Collections.ListDictionaryInternal</Property>
  <Property name="TargetSite">Void GetInterchangeDelimiters(System.String)</Property>
  <Property name="HResult">-2147024809</Property>
  <StackTrace>   at Utility.Converter.Interchange.GetInterchangeDelimiters(String message)
   at Utility.Converter.Interchange..ctor(String message)</StackTrace>
  <additionalInfo>
    <info name="MachineName" value="WEBHOST1" />
    <info name="TimeStamp" value="7/3/2015 2:24:16 PM" />
    <info name="FullName" value="Microsoft.Practices.EnterpriseLibrary.ExceptionHandling, Version=5.0.414.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    <info name="AppDomainName" value="/LM/W3SVC/1/Portal-1-130803822112909360" />
    <info name="ThreadIdentity" value="" />
    <info name="WindowsIdentity" value="WEBUSER" />
  </additionalInfo>
  <InnerException>
    <ExceptionType>System.ArgumentOutOfRangeException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
    <Message>startIndex cannot be larger than length of string.
Parameter name: startIndex</Message>
    <Source>mscorlib</Source>
    <HelpLink />
    <Property name="ActualValue"><undefined value></Property>
    <Property name="ParamName">startIndex</Property>
    <Property name="Data">System.Collections.ListDictionaryInternal</Property>
    <Property name="TargetSite">System.String InternalSubStringWithChecks(Int32, Int32, Boolean)</Property>
    <Property name="HResult">-2146233086</Property>
    <StackTrace>   at System.String.InternalSubStringWithChecks(Int32 startIndex, Int32 length, Boolean fAlwaysCopy)
   at MedData.Edi.Utility.Converter.X12.EdiInterchange.GetInterchangeDelimiters(String ediX12)</StackTrace>
  </InnerException>
</Exception>
Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Have you looked at xpath command?

<your_search> | xpath outfield=MachineName //Exception/additionalInfo/info[@name="MachineName"]/@value

This should work, you may need to adjust the parse a bit. The docs don't have an example of selecting a tag by attribute match. The reference is below if you need additional guidance.

You would need to string together xpath commands to pull each of the info tags and their values.

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Xpath

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Have you looked at xpath command?

<your_search> | xpath outfield=MachineName //Exception/additionalInfo/info[@name="MachineName"]/@value

This should work, you may need to adjust the parse a bit. The docs don't have an example of selecting a tag by attribute match. The reference is below if you need additional guidance.

You would need to string together xpath commands to pull each of the info tags and their values.

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Xpath

Nicolasfm
Engager

Thank you very much for the quick answer!

0 Karma

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...