Can anyone advise on how to extract the fields in the following sample Eventlog Entry using xpath? I can't see to get the syntax right since the Component field repeats. I really want to pull all the fields under RequestAuditComponent type
----------- SNIP --------------
2/21/2020 09:26:55 AM
LogName=Security
SourceName=AD FS Auditing
EventCode=1201
EventType=0
Type=Information
ComputerName=ADFS.contoso.com
User=ADFS_Svc
Sid=S-1-2-19-1257343421-143158401-1347568098-54312
SidType=1
TaskCategory=3
OpCode=Info
RecordNumber=36801840
Keywords=Audit Failure, Classic
Message=The Federation Service failed to issue a valid token. See XML for failure details.
Activity ID: 22cf1b39-bdc5-44ec-a216-411192f514d0
Additional Data
XML: <?xml version="1.0" encoding="utf-16"?>
<AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit">
<AuditType>AppToken</AuditType>
<AuditResult>Failure</AuditResult>
<FailureType>GenericError</FailureType>
<ErrorCode>N/A</ErrorCode>
<ContextComponents>
<Component xsi:type="ResourceAuditComponent">
<RelyingParty>http://fs.contoso.com/adfs/services/trust</RelyingParty>
<ClaimsProvider>N/A</ClaimsProvider>
<UserId>[email protected]</UserId>
</Component>
<Component xsi:type="AuthNAuditComponent">
<PrimaryAuth>N/A</PrimaryAuth>
<DeviceAuth>false</DeviceAuth>
<DeviceId>N/A</DeviceId>
<MfaPerformed>false</MfaPerformed>
<MfaMethod>N/A</MfaMethod>
<TokenBindingProvidedId>false</TokenBindingProvidedId>
<TokenBindingReferredId>false</TokenBindingReferredId>
<SsoBindingValidationLevel>NotSet</SsoBindingValidationLevel>
</Component>
<Component xsi:type="ProtocolAuditComponent">
<OAuthClientId>N/A</OAuthClientId>
<OAuthGrant>N/A</OAuthGrant>
</Component>
<Component xsi:type="RequestAuditComponent">
<Server>http://fs.contoso.com/adfs/services/trust</Server>
<AuthProtocol>WSFederation</AuthProtocol>
<NetworkLocation>Extranet</NetworkLocation>
<IpAddress>10.0.0.1</IpAddress>
<ForwardedIpAddress>10.0.0.1</ForwardedIpAddress>
<ProxyIpAddress>N/A</ProxyIpAddress>
<NetworkIpAddress>N/A</NetworkIpAddress>
<ProxyServer>AZW-XADFS01</ProxyServer>
<UserAgentString>Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:83.0) Gecko/20100101 Firefox/83.0</UserAgentString>
<Endpoint>/adfs/ls/</Endpoint>
</Component>
</ContextComponents>
</AuditBase>
