I have a log that I am trying to parse and I am unable to figure this out. It looks like a type of XML file. Here is an example:
<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
<RequestInformation
Hostname='1.2.3.4'
HostAddress='5.6.7.8'
HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
ReferringPage=''
RequestType='POST'
ContentLength='505'
RawUrl='/dir/subdir/filename.asmx'>
<Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
<Cookies>
</Cookies>
<Form>
</Form>
</RequestInformation>
<Exception Message='ORA-01017: invalid username/password; logon denied'>
<StackTrace>
<![CDATA[
at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleConnection.Open()
at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
]]>
</StackTrace>
</Exception>
</ErrorMessage>
I have the Add-on for Oracle database installed, but it don't seem to work with this one.
Hi,
You could try something like below during the search time by using the spath command
Please rename the fields and use table command to display the fields better,
|makeresults
|eval _raw="<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
<RequestInformation
Hostname='1.2.3.4'
HostAddress='5.6.7.8'
HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
ReferringPage=''
RequestType='POST'
ContentLength='505'
RawUrl='/dir/subdir/filename.asmx'>
<Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
<Cookies>
</Cookies>
<Form>
</Form>
</RequestInformation>
<Exception Message='ORA-01017: invalid username/password; logon denied'>
<StackTrace>
<![CDATA[
at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleConnection.Open()
at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
]]>
</StackTrace>
</Exception>
</ErrorMessage>"
|spath input=_raw
You could also add KV_MODE = xml in the props.conf and breaking the lines appropriately
KV_MODE = xml
Hi,
You could try something like below during the search time by using the spath command
Please rename the fields and use table command to display the fields better,
|makeresults
|eval _raw="<ErrorMessage Id='20200130111127151' Date='1/30/2020' Time='11:11 AM' >
<RequestInformation
Hostname='1.2.3.4'
HostAddress='5.6.7.8'
HostBrowser='Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 4.0.30319.42000)'
ReferringPage=''
RequestType='POST'
ContentLength='505'
RawUrl='/dir/subdir/filename.asmx'>
<Browser Type='IE6' Browser='IE' Version='6.0' Platform='Unknown' SupportsFrames='True' SupportsJavascript='True' SupportsTables='True'SupportsCookies='True'/>
<Cookies>
</Cookies>
<Form>
</Form>
</RequestInformation>
<Exception Message='ORA-01017: invalid username/password; logon denied'>
<StackTrace>
<![CDATA[
at Oracle.DataAccess.Client.OracleException.HandleErrorHelper(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, OpoSqlValCtx* pOpoSqlValCtx, Object src, String procedure, Boolean bCheck, Int32 isRecoverable, OracleLogicalTransaction m_OracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleException.HandleError(Int32 errCode, OracleConnection conn, IntPtr opsErrCtx, Object src, OracleLogicalTransaction m_oracleLogicalTransaction)
at Oracle.DataAccess.Client.OracleConnection.Open()
at dhss.webservice.login_ws.MExecuteComponent.AuthenticateToAPP(String UserID, String Password, String DBInstance, String ServerIP, String ServerPort)
]]>
</StackTrace>
</Exception>
</ErrorMessage>"
|spath input=_raw
You could also add KV_MODE = xml in the props.conf and breaking the lines appropriately
KV_MODE = xml
I have tried the KV_MODE = xml
and it didn't seem to do anything.
Set the linebreaker in props.conf as
LINE_BREAKER = </ErrorMessage>
Now I am seeing results with tick marks, like this
'ASP.NET_SessionId'
looks like this might have been what was needed. thanks.