{"id":9443,"date":"2023-09-25T23:31:00","date_gmt":"2023-09-25T21:31:00","guid":{"rendered":"https:\/\/michlstechblog.info\/blog\/?p=9443"},"modified":"2023-12-20T08:35:13","modified_gmt":"2023-12-20T07:35:13","slug":"xml-selectnode-xpath-query-independend-from-namespace","status":"publish","type":"post","link":"https:\/\/michlstechblog.info\/blog\/xml-selectnode-xpath-query-independend-from-namespace\/","title":{"rendered":"XML: Selectnode XPath query independend from namespace"},"content":{"rendered":"<div class=\"twoclick_social_bookmarks_post_9443 social_share_privacy clearfix 1.6.4 locale-en_US sprite-en_US\"><\/div><div class=\"twoclick-js\"><script type=\"text\/javascript\">\/* <![CDATA[ *\/\njQuery(document).ready(function($){if($('.twoclick_social_bookmarks_post_9443')){$('.twoclick_social_bookmarks_post_9443').socialSharePrivacy({\"services\":{\"flattr\":{\"uid\":\"Michl\",\"status\":\"on\",\"the_title\":\"XML%3A%20Selectnode%20XPath%20query%20independend%20from%20namespace\",\"the_excerpt\":\"Hi%2C%0D%0A%0D%0Ai%20got%20the%20following%20xml%20structure%20and%20want%20to%20select%20just%20the%20the%20%22Data%22%20node%20with%20the%20attribute%20%22CommandLine%22%20without%20defining%20a%20namespace%20object%20first.%0D%0A%20%28more%26hellip%3B%29\",\"txt_info\":\"2 clicks for more data protection:\\r\\n\\r\\nOnly when you click here, the button will be come active and you can send your recommendation to Flattr. When activating, data are transmitted to third parties. \",\"perma_option\":\"off\"}},\"txt_help\":\"When you activate these fields by clicking, information to Flattr may be transferred abroad, and probably may also stored there.\",\"settings_perma\":\"Enable permanently and accept data transmission. \",\"info_link\":\"http:\\\/\\\/www.heise.de\\\/ct\\\/artikel\\\/2-Klicks-fuer-mehr-Datenschutz-1333879.html\",\"uri\":\"https:\\\/\\\/michlstechblog.info\\\/blog\\\/xml-selectnode-xpath-query-independend-from-namespace\\\/\",\"post_id\":9443,\"post_title_referrer_track\":\"XML%3A+Selectnode+XPath+query+independend+from+namespace\",\"display_infobox\":\"on\"});}});\n\/* ]]> *\/<\/script><\/div><p>Hi,<\/p>\n<p>i got the following xml structure and want to select just the the &#8220;Data&#8221; node with the attribute &#8220;CommandLine&#8221; without defining a namespace object first.<br \/>\n<!--more--><\/p>\n<pre class=\"brush: xml; title: ; notranslate\" title=\"\">\r\n&lt;Event xmlns=&quot;http:\/\/schemas.microsoft.com\/win\/2004\/08\/events\/event&quot;&gt;\r\n  &lt;System&gt;\r\n  &lt;Provider Name=&quot;Microsoft-Windows-Sysmon&quot; Guid=&quot;{5770385f-c22a-43e0-bf4c-06f5698ffbd9}&quot; \/&gt; \r\n  &lt;EventID&gt;1&lt;\/EventID&gt; \r\n  &lt;Version&gt;5&lt;\/Version&gt; \r\n  &lt;Level&gt;4&lt;\/Level&gt; \r\n  &lt;Task&gt;1&lt;\/Task&gt; \r\n  &lt;Opcode&gt;0&lt;\/Opcode&gt; \r\n  &lt;Keywords&gt;0x8000000000000000&lt;\/Keywords&gt; \r\n  &lt;TimeCreated SystemTime=&quot;2023-09-25 22:22:32.601&quot; \/&gt; \r\n  &lt;EventRecordID&gt;124756&lt;\/EventRecordID&gt; \r\n  &lt;Correlation \/&gt; \r\n  &lt;Execution ProcessID=&quot;4168&quot; ThreadID=&quot;5480&quot; \/&gt; \r\n  &lt;Channel&gt;Microsoft-Windows-Sysmon\/Operational&lt;\/Channel&gt; \r\n  &lt;Computer&gt;myCOmputer.myDomain.org&lt;\/Computer&gt; \r\n  &lt;Security UserID=&quot;S-1-5-18&quot; \/&gt; \r\n  &lt;\/System&gt;\r\n- &lt;EventData&gt;\r\n  &lt;Data Name=&quot;RuleName&quot;&gt;-&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;UtcTime&quot;&gt;2023-09-25 22:22:32.601&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ProcessGuid&quot;&gt;{e8ff26e2-7b88-6511-dbe6-010000003e00}&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ProcessId&quot;&gt;7240&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;Image&quot;&gt;C:\\Windows\\System32\\conhost.exe&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;FileVersion&quot;&gt;10.0.19041.3393 (WinBuild.160101.0800)&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;Description&quot;&gt;Console Window Host&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;Product&quot;&gt;Microsoft\u00ae Windows\u00ae Operating System&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;Company&quot;&gt;Microsoft Corporation&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;OriginalFileName&quot;&gt;CONHOST.EXE&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;CommandLine&quot;&gt;\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;CurrentDirectory&quot;&gt;C:\\Windows&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;User&quot;&gt;myUser&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;LogonGuid&quot;&gt;{e8ff26e2-3dbf-6511-eec4-160000000000}&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;LogonId&quot;&gt;0x16c4ee&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;TerminalSessionId&quot;&gt;0&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;IntegrityLevel&quot;&gt;High&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;Hashes&quot;&gt;SHA1=805D59ABED301A4A8219531544EDC1742207F8AD,MD5=7366FBEFE66BA0F1F5304F7D6FEF09FE,SHA256=5C7AA6C7D6CC9B7BF66B39BFBA334DE236EEFDD5E790545CED4C2E42600F8794,IMPHASH=0F64302D3280DE299F4C51A78746F606&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ParentProcessGuid&quot;&gt;{e8ff26e2-7b88-6511-dae6-010000003e00}&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ParentProcessId&quot;&gt;12168&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ParentImage&quot;&gt;cmd.exe&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ParentCommandLine&quot;&gt;dmc.exe 6384&lt;\/Data&gt; \r\n  &lt;Data Name=&quot;ParentUser&quot;&gt;myUser&lt;\/Data&gt; \r\n  &lt;\/EventData&gt;\r\n&lt;\/Event&gt;\r\n<\/pre>\n<p>This can be done by XPATH and the <strong>local-name()<\/strong> function. Environment is Powershell\/.NET. .NET only supports XPATH 1.0 queries.<\/p>\n<p>In this example the XML Object is in the variable $XML. The local-name()=&#8217;Data&#8217; sets a filter for all nodes with Name Data and @Name filters the attribute where Name=CommandLine.<\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\r\nPS D:\\&gt; $XML.Event.EventData.SelectNodes(&quot;*&#x5B;local-name()='Data' and @Name='CommandLine']&quot;)\r\nName        #text\r\n----        -----\r\nCommandLine \\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1\r\n<\/pre>\n<p>I know in this example Name=CommandLine would be sufficient \ud83d\ude42 <\/p>\n<p>Michael<\/p>\n<div name=\"divHrefB\" style=\"height: 0px;width: 0px;overflow:hidden;\">This may not especially need Biomedical and the resistance of databases should be presented in blood. <a href=\"https:\/\/swissarabic.ch\/tmp\/.pk\/abaglin\/index.html\">Osta Yleinen Abaglin (Neurontin) ilman Resepti&#228;<\/a> Checks for prescription are conducted out in the high healthcare which is remainder of the using internet. Most special participants are read in website with an inappropriate month resistance. Pharmacy in Ethiopia dicloxacillin at AMR College.<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Hi, i got the following xml structure and want to select just the the &#8220;Data&#8221; node with the attribute &#8220;CommandLine&#8221; without defining a namespace object first.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[344,152],"tags":[2002,2003,2001,861,2004],"class_list":["post-9443","post","type-post","status-publish","format-standard","hentry","category-powershell-scripting","category-xml","tag-independend","tag-namespace","tag-selectnode","tag-xml","tag-xpath"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/9443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/comments?post=9443"}],"version-history":[{"count":6,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/9443\/revisions"}],"predecessor-version":[{"id":9449,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/9443\/revisions\/9449"}],"wp:attachment":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/media?parent=9443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/categories?post=9443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/tags?post=9443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}