Hello ALL:

I need to use powershell to loop through all root nodes, and in each root search for type='INCEDENT_ERROR'.

Would you guide me how to start with powershell.

Thank you very much.
-andy

----------------------------------
Here is input sample.

 client_id='' type='UNKNOWN' level='16'
 host_id='SCRDCPKRNDB01C' host_addr='192.168.0.171' module='sqlplus.exe'
 pid='4760' version='1'>
 ALTER SYSTEM SET diagnostic_dest='J:\ORACLE' SCOPE=BOTH;
 

 msg_id='ksb_shut_detached_process:2876:3107995654' client_id='' type='NOTIFICATION'
 group='process end' level='16' host_id='SCRDCPKRNDB01C'
 host_addr='192.168.0.171' module='sqlplus.exe' pid='4760'>
 Stopping background process MMON
 

 msg_id='1257497642' type='INCIDENT_ERROR' group='Out of Memory'
 level='1' host_id='SCRDCPKRNDB01C' host_addr='192.168.0.171'
 prob_key='ORA 4031' upstream_comp='' downstream_comp='KGH'
 ecid='' errid='691650' detail_path='J:\ORACLE\diag\rdbms\wfcprod\wfcprod\trace\wfcprod_m001_1000.trc'>
 
 Errors in file J:\ORACLE\diag\rdbms\wfcprod\wfcprod\trace\wfcprod_m001_1000.trc  (incident=691650):
ORA-04031: unable to allocate 3936 bytes of shared memory ("shared pool","insert into WRH$_RSRC_CONSUM...","sga heap(2,0)","kglsim object batch")
 

you need to mark that as code or something so the xml gets through

The forum parsed the xml sample code. So I have to attached the sample.

The simplest thing is to take that content and wrap it into a single new root node so that you can parse it as XML.

Let's assume you have a bunch of those nodes in text file incidents.log

We can use Select-Xml, but we need to wrap the xml so there's only one root node (XML only allows one). Let's call that node "x"

$LogText= Get-Content incidents.log
Select-Xml -content "$messages" -xpath "//msg[@type='INCIDENT_ERROR']"

The xpath here is very simple, it says find a node at any depth that is named "msg" ("//msg") and that has an attribute named type ([@type]) with the value of  "INCIDENT_ERROR" (='INCIDENT_ERROR').

You should get back one or more XmlNode objects that you can do whatever you want with.