Solved

Simple Xpath Query

Posted on 2012-03-26
10
788 Views
Last Modified: 2012-03-26
Hi,

I want to write some xpath that queries the event document below.

Here is my pseudo code

Give me all the Event/EventData/Data WHERE Event/Provider[@Name = "MYWCF Service" AND WHERE Event/TimeCreated[@SystemTime IS GREATER THAN "2012-03-23"

Here is my document.

<Event>
<System>
  <Provider Name="MyWCF Service" />
  <EventID Qualifiers="0">0</EventID>
  <Level>4</Level>
  <Task>0</Task>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2012-03-23T10:43:02.000000000Z" />
  <EventRecordID>260031</EventRecordID>
  <Channel>Application</Channel>
  <Computer>TPR-ITSS-016.btn.opra.gov.uk</Computer>
  <Security />
  </System>
<EventData>
  <Data>2012-03-23 10:43:02,064 [14] DEBUG NHibernate.Engine.CascadingAction [(null)] - cascading to saveOrUpdate: TPR.Brunswick.Models.Milestone</Data>
  </EventData>
  </Event>
0
Comment
Question by:MrKevorkian
  • 6
  • 4
10 Comments
 
LVL 60

Accepted Solution

by:
Geert Bormans earned 500 total points
ID: 37765266
Event[System/Provider/@Name = "MYWCF Service"][translate(substring-before(System/TimeCreated/@SystemTime, 'T'), '-', '') > 20120323 ]/EventData/Data
0
 
LVL 1

Author Comment

by:MrKevorkian
ID: 37765269
just trying it out!
0
 
LVL 1

Author Comment

by:MrKevorkian
ID: 37765274
It gives me

Unexpected type - found '20120323' of type xs:integer, expected type xs:string
0
 
LVL 60

Expert Comment

by:Geert Bormans
ID: 37765293
OK, type casting error,
I assumed you were using XPath 1.0
Apparently you are using XPath 2.0
We can be more smart with the dates then

In which context are you using this?
In an XQuery or XSLT2?

And what exactly do you want the test with the date to do?
Does you XML matches your restriction?
So 1 minute past midnight in the morning of 23/2 is considered later than 23/2?
0
 
LVL 1

Author Comment

by:MrKevorkian
ID: 37765299
Hi,

I just evaluated your code using xml spy (latest version) .

In reality I will be running the code using C# 4.0 on Windows Server 2008.

I think XPath 1.0 will probably work.

Let me test it in a console app quickly.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 60

Expert Comment

by:Geert Bormans
ID: 37765367
note that the "=" test for strings is case sensitive
"MyWCF" will not match "MYWCF"
0
 
LVL 1

Author Comment

by:MrKevorkian
ID: 37765410
Hi,

Thanks alot got it working in my console (with a little tweak). This seems to work.

*[System[(Provider/@Name = 'MyWCF Service') and TimeCreated[@SystemTime >= translate("2008-02-21", '-', '')]]]/EventData/Data
0
 
LVL 1

Author Closing Comment

by:MrKevorkian
ID: 37765411
super quick answer!
0
 
LVL 60

Expert Comment

by:Geert Bormans
ID: 37765431
welcome,

the construct with the time does not seem right to me in your tweaked version

you are doing the translate on the fixed string, the only difference with the numeric I had is that the result is a string, but putting quotes has the same effect "20080221"
I wonder how dierct SystemTime could work given that XPath1 only knows about strings and numeric
might be that msxml does the right thing
... but hey, if it works, it works :-)
0
 
LVL 1

Author Comment

by:MrKevorkian
ID: 37765438
Thanks, I will have another look at the time comparison as you have suggested.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

In my previous two articles we discussed Binary Serialization (http://www.experts-exchange.com/A_4362.html) and XML Serialization (http://www.experts-exchange.com/A_4425.html). In this article we will try to know more about SOAP (Simple Object Acces…
For those of you who don't follow the news, or just happen to live under rocks, Microsoft Research released a beta SDK (http://www.microsoft.com/en-us/download/details.aspx?id=27876) for the Xbox 360 Kinect. If you don't know what a Kinect is (http:…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now