Getting Data In

unable to get XML to parse correctly

cboillot
Contributor

Got an XML file that for the life of me I can not get parse correctly. I have tried to use LINE_BREAKER on the 1st line, on '(greaterthan)ErrorMessage' and also tried to 'MUST_BREAK_AFTER' '(greaterthan)/ErrorMessage(lessthan)'. What happens is that it keeps breaking at (using example data below) '(greaterthan)Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/(lessthan)' so what should be 1 events gets broken into 2.

<!-- ------------------------------------------------------- -->
<ErrorMessage Id='20181026101115422' Date='10/26/2018' Time='10:11 AM' >
  <CurrentUser UserName='user1 Instance='DEVO'/>
  <RequestInformation
     Hostname='10.xxx.xxx.xxx' 
     HostAddress='10.xxx.xxx.xxx'
     HostBrowser='Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; wbx 1.0.0)'
     ReferringPage='https://web.site.com'
     RequestType='GET'
     ContentLength='0'
     RawUrl='/BSEES/BackGroundScreeningResultsScreening.aspx?sk=SK1943959381'>
    <Browser Type='IE7' Browser='IE' Version='7.0' Platform='WinNT' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
    <Cookies>
      <Cookie Name='visid_incap_1275982' Value='lNef3NDSQcyOf0lXjW2Nrx+G0FsAAAAAQUIPAAAAAAAt8gyRIE8R8UaxAc228cmJ'/>
      <Cookie Name='incap_ses_1000_1275982' Value='dRL7TVrvM16YD3QZKLfgDWIu01sAAAAA6zG7B1/C6/5Pjit48Gj4RQ=='/>
      <Cookie Name='ASP.NET_SessionId' Value='cptssgf1ynquuwwic3kvna21'/>
      <Cookie Name='us' Value='uname=eLsRhq6hvGqJYmT2mOc%2f8w%3d%3d'/>
      <Cookie Name='starttime' Value='10/26/2018 10:10:36 AM'/>
    </Cookies>
    <Form>
    </Form>
  </RequestInformation>
  <Exception Message='System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> System.Exception: MSHP userid not found for the current userid: user1
   at BSEES_HPMQ_WS.HPDAComp.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.vb:line 489
   at BSEES_HPMQ_WS.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\COMMON\file.asmx.vb:line 78
   --- End of inner exception stack trace ---'>
    <StackTrace>
      <![CDATA[
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   at BSEES_WS_Proxy.svcBSEESHPMQ.BSEES_HPMQService.RunHPInqForPartyId(Int64 p_partyId) in C:\_Sandboxes\Systems\BSEES\file.vb:line 138
   at BSEES.BackGroundScreeningResultsScreening.DISPLAY_CSHP_RESULTS() in C:\_Sandboxes\Systems\file.aspx.vb:line 621
]]>
    </StackTrace>
  </Exception>
</ErrorMessage>
Tags (3)
0 Karma

markusspitzli
Communicator

Try this one:

LINE_BREAKER=([\r\n])\<ErrorMessage
0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...