Policy Guide › Data Lookup › XML Attribute Lookup › XML Attribute Lookup Syntax

XML Attribute Lookup Syntax

Simple Commands

These commands test a simple True or False statement relating to an XML attribute. For example, a lookup command may test the file name of an imported file. The syntax is:

xmlattr [WITH <xpath>] [labeled <offlimits>] WHERE <xpath> [labeled <offlimits>] <stringoperator|numericoperator> <attribvalue>

Where:

<xpath> specifies an element within the XML schema for event metadata.

<attribvalue> must be enclosed in double quotes. The simple example below detects all files created on or after 10am, 18 May 2009 UTC (equivalent to 6am EST during daylight saving time):

xmlattr WHERE apm/event/file/created >= "2009-05-18T10:00:00"

Note: Be aware that dates and times are stored as UTC.

WITH and WHERE Statements

In a simple xmlattr lookup command, the WHERE statement locates and identifies the actual file attribute whose value is to be tested.

But xmlattr lookup commands can optionally include a WITH statement to locate the attributes, allowing the use of simplified WHERE statements to identify which attributes to test. This is useful if you want to test multiple attributes. For example, the filename and size attributes are both located on the file XML node; the command below tests for MS Word documents over 1Mb:

xmlattr WITH apm/event/file WHERE (filename IS "*.doc") AND (size > 1048576)

Property Sets

The metadata for a file can include one or more property sets. A property set is a collection of related file properties. The <xpath> syntax for referencing a property is:

apm/event/file/property_set[@name=<set name>]/property[@name=<property name>]

Where <set name> and <property name> must be enclosed in double quotes. For example:

• Microsoft Word documents include a 'Summary' property set that includes 'TotalEditingTime' and 'WordCount' properties. The following command causes a trigger to fire when the word count in a document is greater than 10,000:

  xmlattr WHERE apm/event/file/property_set[@name="Summary"]/property[@name="WordCount"] > 10000
  

• You may want to identify specific items when the FSA scans items in Exchange Public Folders. These items include an ‘Exchange’ property set that contains a ‘MessageClass’ property.

  The following command causes a trigger to fire when the FSA detects a note item. As a result, the FSA includes these items in the scan:

  xmlattr WHERE apm/event/file/property_set[@name="Exchange"]/property[@name="MessageClass"] = "IPM.Note"
  

  Conversely, the following command prevents a trigger from firing when the FSA detects appointment or meeting request items. As a result, the FSA excludes these items from the scan:

  xmlattr WHERE apm/event/file/property_set[@name="Exchange"]/property [@name="MessageClass"] IS NOT "IPM.Appointment" 
  

  Note: IPM.Appointment item types include appointments and meeting requests.

  The other main items in Exchange Public Folders are contacts and tasks. The ‘MessageClass’ property for a contact is IPM.Contact. The ‘MessageClass’ property for a task is IPM.Task.

Complex Commands

More complex commands can include WITH, AND, OR and NOT operators to combine multiple True or False tests. For example, a command may look for files created after 14 May and before 18 May.

Dates and Times Stored in UTC

CA DataMinder stores all date and time metadata in UTC (Coordinated Universal Time). Your xmlattr lookup commands must therefore specify UTC dates and times.

For example, a file is created at 11am, 18 May 2009 in New York during daylight saving time (UTC-4). Therefore, the data lookup command to find this file must a specify a 3pm file creation time:

xmlattr WHERE apm/event/file/created >= "2009-05-18T15:00:00"

Note:The iConsole and Data Management console convert dates and times back to local time when displaying the associated events.

More information:

XML Attribute Lookup Examples

XML Metadata Examples

<Attribvalue>

<Xpath>