Getting Data In

unable to get XML to parse correctly

cboillot
Contributor

Got an XML file that for the life of me I can not get parse correctly. I have tried to use LINE_BREAKER on the 1st line, on '(greaterthan)ErrorMessage' and also tried to 'MUST_BREAK_AFTER' '(greaterthan)/ErrorMessage(lessthan)'. What happens is that it keeps breaking at (using example data below) '(greaterthan)Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/(lessthan)' so what should be 1 events gets broken into 2.

<!-- ------------------------------------------------------- -->
<ErrorMessage Id='20181026101115422' Date='10/26/2018' Time='10:11 AM' >
  <CurrentUser UserName='user1 Instance='DEVO'/>
  <RequestInformation
     Hostname='10.xxx.xxx.xxx' 
     HostAddress='10.xxx.xxx.xxx'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0)'
     ReferringPage='https://web.site.com'
     RequestType='GET'
     ContentLength='0'
     RawUrl='/BSEES/BackGroundScreeningResultsScreening.aspx?sk=SK1943959381'>
    <Browser Type='IE7' Browser='IE' Version='7.0' Platform='WinNT' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
      <Cookie Name='visid_incap_1275982' Value='lNef3NDSQcyOf0lXjW2Nrx+G0FsAAAAAQUIPAAAAAAAt8gyRIE8R8UaxAc228cmJ'/>
      <Cookie Name='incap_ses_1000_1275982' Value='dRL7TVrvM16YD3QZKLfgDWIu01sAAAAA6zG7B1/C6/5Pjit48Gj4RQ=='/>
      <Cookie Name='ASP.NET_SessionId' Value='cptssgf1ynquuwwic3kvna21'/>
      <Cookie Name='us' Value='uname=eLsRhq6hvGqJYmT2mOc%2f8w%3d%3d'/>
      <Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.Exception: MSHP userid not found for the current userid: user1
   at BSEES_HPMQ_WS.HPDAComp.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.vb:line 489
   at BSEES_HPMQ_WS.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.asmx.vb:line 78
   --- End of inner exception stack trace ---'>
    <StackTrace>
      <![CDATA[
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at BSEES_WS_Proxy.svcBSEESHPMQ.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\BSEES\file.vb:line 138
   at BSEES.BackGroundScreeningResultsScreening.DISPLAY_CSHP_RESULTS() in C:\_Sandboxes\Systems\file.aspx.vb:line 621
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>
Tags (3)
0 Karma

markusspitzli
Communicator

Try this one:

LINE_BREAKER=([\r\n])\<ErrorMessage
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Raw Data to Executive-Ready Stories, Faster

Build Data Stories for Every Audience  A dashboard is rarely just a dashboard. It might be the view an ...

Guided Onboarding with Auto-schema Is Now Generally Available

  We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...