Parse Complex XML Node Name/Value

[Nicolasfm]

I have a log file which is written out in XML through Microsoft.Practices.EnterpriseLibrary.ExceptionHandling. I want to be able to get key elements out so I can report on the exception message.
Specifcally looking for

• Exception/additionalInfo/info{MachineName}.value

I would like to create an extract field for it but really do not know where to start so I can search on the value or print the value directly, instead of Name showing with all the name values and then Values showing with all the value options based on the following parameters

• Exception.additionalInfo.info{@name}
• Exception.additionalInfo.info{@value}

Sample Log File

<Exception handlingInstanceId="d419e407-c5d0-4d57-a44d-baeea7948192">
  <Description>An exception of type 'System.ArgumentException' occurred and was caught.</Description>
  <DateTime>2015-07-03 09:24:16Z</DateTime>
  <ExceptionType>System.ArgumentException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
  <Message>Invalid message, exception trying to get file interchange delimiters.</Message>
  <Source>Utility.Converter</Source>
  <HelpLink />
  <Property name="ParamName"><undefined value></Property>
  <Property name="Data">System.Collections.ListDictionaryInternal</Property>
  <Property name="TargetSite">Void GetInterchangeDelimiters(System.String)</Property>
  <Property name="HResult">-2147024809</Property>
  <StackTrace>   at Utility.Converter.Interchange.GetInterchangeDelimiters(String message)
   at Utility.Converter.Interchange..ctor(String message)</StackTrace>
  <additionalInfo>
    <info name="MachineName" value="WEBHOST1" />
    <info name="TimeStamp" value="7/3/2015 2:24:16 PM" />
    <info name="FullName" value="Microsoft.Practices.EnterpriseLibrary.ExceptionHandling, Version=5.0.414.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    <info name="AppDomainName" value="/LM/W3SVC/1/Portal-1-130803822112909360" />
    <info name="ThreadIdentity" value="" />
    <info name="WindowsIdentity" value="WEBUSER" />
  </additionalInfo>
  <InnerException>
    <ExceptionType>System.ArgumentOutOfRangeException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>
    <Message>startIndex cannot be larger than length of string.
Parameter name: startIndex</Message>
    <Source>mscorlib</Source>
    <HelpLink />
    <Property name="ActualValue"><undefined value></Property>
    <Property name="ParamName">startIndex</Property>
    <Property name="Data">System.Collections.ListDictionaryInternal</Property>
    <Property name="TargetSite">System.String InternalSubStringWithChecks(Int32, Int32, Boolean)</Property>
    <Property name="HResult">-2146233086</Property>
    <StackTrace>   at System.String.InternalSubStringWithChecks(Int32 startIndex, Int32 length, Boolean fAlwaysCopy)
   at MedData.Edi.Utility.Converter.X12.EdiInterchange.GetInterchangeDelimiters(String ediX12)</StackTrace>
  </InnerException>
</Exception>

[alacercogitatus · Accepted solution]

Have you looked at xpath command?

<your_search> | xpath outfield=MachineName //Exception/additionalInfo/info[@name="MachineName"]/@value

This should work, you may need to adjust the parse a bit. The docs don't have an example of selecting a tag by attribute match. The reference is below if you need additional guidance.

You would need to string together xpath commands to pull each of the info tags and their values.

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Xpath

[Nicolasfm]

Thank you very much for the quick answer!

[woodcock]

You need the xpath command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath