Separating XML events by tag

[smcdonald20]

Hi,

I need to ensure that each event breaks after the tag in my XML source.
How can i do this?

I've tried updating the props.conf file with the below, but it doesn't seem to be working.

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
MUST_BREAK_AFTER = "^<\/GPO>$"

[somesoni2]

Do you want to keep everything between, including these tags, as one event?

<GPO>...stuffs</\/GPO>

If yes, give this a try
Updated per last comment

[xml]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
SHOULD_LINEMERGE =false
LINE_BREAKER = ([\r\n]+)(?=\s*\<GPO\s+xmlns)

[sbbadri]

can you post sample data

try this,

MUST_BREAK_AFTER = <\/GPO>

[niketn]

@smcdonald20, can you add mocked up sample data for this as well?

[smcdonald20]

Yes.

Please see below.

The events begin with this line: {noformat} {noformat}

And ends with <\GPO>

 {noformat}
 false
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>0</VersionDirectory>
<VersionSysvol>0</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>
<ExtensionData>
  <Extension xmlns:q1="http://www.microsoft.com/GroupPolicy/Settings/Registry" xsi:type="q1:RegistrySettings">
    <q1:Policy>
      <q1:Name>All Removable Storage classes: Deny all access</q1:Name>
      <q1:State>Disabled</q1:State>
      <q1:Explain>Configure access to all removable storage classes.
This policy setting takes precedence over any individual removable storage policy settings. To manage 
individual classes, use the policy settings available for each class.
If you enable this policy setting, no access is allowed to any removable storage class.
If you disable or do not configure this policy setting, write and read accesses are allowed to all 
removable storage classes.
      <q1:Supported>At least Windows Vista</q1:Supported>
      <q1:Category>System/Removable Storage Access</q1:Category>
    </q1:Policy>
  </Extension>
  <Name>Registry</Name>
</ExtensionData>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/PIPE/phillimore.com/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>




<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{C2606FE1-FAD1-4431-A512-D5B7C9F3923A}</Identifier>
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">options-it.com</Domain>

WBT Users
true
2017-09-19T11:25:22
2017-09-19T11:25:22
2017-09-19T12:48:31.4658229Z

<SDDL xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">O:DAG:DAD:PAI(OA;CI;CR;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1060284298-1275210071-1417001333-519)(A;CI;LCRPLORC;;;ED)(A;CI;LCRPLORC;;;AU)(A;CI;CCDCLCSWRPWPDTLOSDRCWDWO;;;SY)(A;CIIO;CCDCLCSWRPWPDTLOSDRCWDWO;;;CO)S:AI(AU;CIIDSA;CCDCSWWPDTLOCRSDWDWO;;;WD)(AU;CIIDFA;CCDCSWWPDTCRSDWDWO;;;WD)</SDDL>
<Owner xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Owner>
<Group xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
  <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
</Group>
<PermissionsPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">true</PermissionsPresent>
<Permissions xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">
  <InheritsFromParent>false</InheritsFromParent>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-512</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Domain Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-9</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Read</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-18</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\SYSTEM</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-21-1060284298-1275210071-1417001333-519</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">OPTIONS-IT\Enterprise Admins</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Edit, delete, modify security</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
  <TrusteePermissions>
    <Trustee>
      <SID xmlns="http://www.microsoft.com/GroupPolicy/Types">S-1-5-11</SID>
      <Name xmlns="http://www.microsoft.com/GroupPolicy/Types">NT AUTHORITY\Authenticated Users</Name>
    </Trustee>
    <Type xsi:type="PermissionType">
      <PermissionType>Allow</PermissionType>
    </Type>
    <Inherited>false</Inherited>
    <Applicability>
      <ToSelf>true</ToSelf>
      <ToDescendantObjects>false</ToDescendantObjects>
      <ToDescendantContainers>true</ToDescendantContainers>
      <ToDirectDescendantsOnly>false</ToDirectDescendantsOnly>
    </Applicability>
    <Standard>
      <GPOGroupedAccessEnum>Apply Group Policy</GPOGroupedAccessEnum>
    </Standard>
    <AccessMask>0</AccessMask>
  </TrusteePermissions>
</Permissions>
<AuditingPresent xmlns="http://www.microsoft.com/GroupPolicy/Types/Security">false</AuditingPresent>

true

<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<VersionDirectory>1</VersionDirectory>
<VersionSysvol>1</VersionSysvol>
<Enabled>true</Enabled>


<SOMName>Users</SOMName>
<SOMPath>options-it.com/Hosting/Hosting/webbtraders.nl/Users</SOMPath>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>


{noformat}

[smcdonald20]

Sorry, the above is not formatting well 😞

The start of each event begins with this,

<GPO xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.microsoft.com/GroupPolicy/Settings">

The end of each event will end with this

</gpo>