I am attempting to ingest the output of the Microsoft Powershell GPO Report Export (i.e. Get-GPOReport -All -ReportType XML -Path c:\report.xml).
The following props.conf splits the output into the separate individual GPO sections into Events (...).
[xml_source]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = ([\r\n]*)(?=\s*\Default Domain Policy
true
2002-09-17T07:41:34
2017-09-02T01:59:14
2017-09-19T12:34:59.5821172Z
↧