Getting Data In

unable to get XML to parse correctly

cboillot
Contributor

Got an XML file that for the life of me I can not get parse correctly. I have tried to use LINE_BREAKER on the 1st line, on '(greaterthan)ErrorMessage' and also tried to 'MUST_BREAK_AFTER' '(greaterthan)/ErrorMessage(lessthan)'. What happens is that it keeps breaking at (using example data below) '(greaterthan)Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/(lessthan)' so what should be 1 events gets broken into 2.

<!-- ------------------------------------------------------- -->
<ErrorMessage Id='20181026101115422' Date='10/26/2018' Time='10:11 AM' >
  <CurrentUser UserName='user1 Instance='DEVO'/>
  <RequestInformation
     Hostname='10.xxx.xxx.xxx' 
     HostAddress='10.xxx.xxx.xxx'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0)'
     ReferringPage='https://web.site.com'
     RequestType='GET'
     ContentLength='0'
     RawUrl='/BSEES/BackGroundScreeningResultsScreening.aspx?sk=SK1943959381'>
    <Browser Type='IE7' Browser='IE' Version='7.0' Platform='WinNT' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
      <Cookie Name='visid_incap_1275982' Value='lNef3NDSQcyOf0lXjW2Nrx+G0FsAAAAAQUIPAAAAAAAt8gyRIE8R8UaxAc228cmJ'/>
      <Cookie Name='incap_ses_1000_1275982' Value='dRL7TVrvM16YD3QZKLfgDWIu01sAAAAA6zG7B1/C6/5Pjit48Gj4RQ=='/>
      <Cookie Name='ASP.NET_SessionId' Value='cptssgf1ynquuwwic3kvna21'/>
      <Cookie Name='us' Value='uname=eLsRhq6hvGqJYmT2mOc%2f8w%3d%3d'/>
      <Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.Exception: MSHP userid not found for the current userid: user1
   at BSEES_HPMQ_WS.HPDAComp.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.vb:line 489
   at BSEES_HPMQ_WS.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.asmx.vb:line 78
   --- End of inner exception stack trace ---'>
    <StackTrace>
      <![CDATA[
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at BSEES_WS_Proxy.svcBSEESHPMQ.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\BSEES\file.vb:line 138
   at BSEES.BackGroundScreeningResultsScreening.DISPLAY_CSHP_RESULTS() in C:\_Sandboxes\Systems\file.aspx.vb:line 621
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>
Tags (3)
0 Karma

markusspitzli
Communicator

Try this one:

LINE_BREAKER=([\r\n])\<ErrorMessage
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...