Getting Data In

unable to get XML to parse correctly

cboillot
Contributor

Got an XML file that for the life of me I can not get parse correctly. I have tried to use LINE_BREAKER on the 1st line, on '(greaterthan)ErrorMessage' and also tried to 'MUST_BREAK_AFTER' '(greaterthan)/ErrorMessage(lessthan)'. What happens is that it keeps breaking at (using example data below) '(greaterthan)Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/(lessthan)' so what should be 1 events gets broken into 2.

<!-- ------------------------------------------------------- -->
<ErrorMessage Id='20181026101115422' Date='10/26/2018' Time='10:11 AM' >
  <CurrentUser UserName='user1 Instance='DEVO'/>
  <RequestInformation
     Hostname='10.xxx.xxx.xxx' 
     HostAddress='10.xxx.xxx.xxx'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0)'
     ReferringPage='https://web.site.com'
     RequestType='GET'
     ContentLength='0'
     RawUrl='/BSEES/BackGroundScreeningResultsScreening.aspx?sk=SK1943959381'>
    <Browser Type='IE7' Browser='IE' Version='7.0' Platform='WinNT' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
      <Cookie Name='visid_incap_1275982' Value='lNef3NDSQcyOf0lXjW2Nrx+G0FsAAAAAQUIPAAAAAAAt8gyRIE8R8UaxAc228cmJ'/>
      <Cookie Name='incap_ses_1000_1275982' Value='dRL7TVrvM16YD3QZKLfgDWIu01sAAAAA6zG7B1/C6/5Pjit48Gj4RQ=='/>
      <Cookie Name='ASP.NET_SessionId' Value='cptssgf1ynquuwwic3kvna21'/>
      <Cookie Name='us' Value='uname=eLsRhq6hvGqJYmT2mOc%2f8w%3d%3d'/>
      <Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.Exception: MSHP userid not found for the current userid: user1
   at BSEES_HPMQ_WS.HPDAComp.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.vb:line 489
   at BSEES_HPMQ_WS.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.asmx.vb:line 78
   --- End of inner exception stack trace ---'>
    <StackTrace>
      <![CDATA[
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at BSEES_WS_Proxy.svcBSEESHPMQ.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\BSEES\file.vb:line 138
   at BSEES.BackGroundScreeningResultsScreening.DISPLAY_CSHP_RESULTS() in C:\_Sandboxes\Systems\file.aspx.vb:line 621
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>
Tags (3)
0 Karma

markusspitzli
Communicator

Try this one:

LINE_BREAKER=([\r\n])\<ErrorMessage
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

How Edge Processor's Durable Queue Works

Edge Processor sits in one of the most consequential places in any Splunk pipeline: between your data sources ...