Getting Data In

unable to get XML to parse correctly

cboillot
Contributor

Got an XML file that for the life of me I can not get parse correctly. I have tried to use LINE_BREAKER on the 1st line, on '(greaterthan)ErrorMessage' and also tried to 'MUST_BREAK_AFTER' '(greaterthan)/ErrorMessage(lessthan)'. What happens is that it keeps breaking at (using example data below) '(greaterthan)Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/(lessthan)' so what should be 1 events gets broken into 2.

<!-- ------------------------------------------------------- -->
<ErrorMessage Id='20181026101115422' Date='10/26/2018' Time='10:11 AM' >
  <CurrentUser UserName='user1 Instance='DEVO'/>
  <RequestInformation
     Hostname='10.xxx.xxx.xxx' 
     HostAddress='10.xxx.xxx.xxx'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0)'
     ReferringPage='https://web.site.com'
     RequestType='GET'
     ContentLength='0'
     RawUrl='/BSEES/BackGroundScreeningResultsScreening.aspx?sk=SK1943959381'>
    <Browser Type='IE7' Browser='IE' Version='7.0' Platform='WinNT' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
      <Cookie Name='visid_incap_1275982' Value='lNef3NDSQcyOf0lXjW2Nrx+G0FsAAAAAQUIPAAAAAAAt8gyRIE8R8UaxAc228cmJ'/>
      <Cookie Name='incap_ses_1000_1275982' Value='dRL7TVrvM16YD3QZKLfgDWIu01sAAAAA6zG7B1/C6/5Pjit48Gj4RQ=='/>
      <Cookie Name='ASP.NET_SessionId' Value='cptssgf1ynquuwwic3kvna21'/>
      <Cookie Name='us' Value='uname=eLsRhq6hvGqJYmT2mOc%2f8w%3d%3d'/>
      <Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.Exception: MSHP userid not found for the current userid: user1
   at BSEES_HPMQ_WS.HPDAComp.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.vb:line 489
   at BSEES_HPMQ_WS.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.asmx.vb:line 78
   --- End of inner exception stack trace ---'>
    <StackTrace>
      <![CDATA[
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at BSEES_WS_Proxy.svcBSEESHPMQ.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\BSEES\file.vb:line 138
   at BSEES.BackGroundScreeningResultsScreening.DISPLAY_CSHP_RESULTS() in C:\_Sandboxes\Systems\file.aspx.vb:line 621
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>
Tags (3)
0 Karma

markusspitzli
Communicator

Try this one:

LINE_BREAKER=([\r\n])\<ErrorMessage
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...