Tenable Add-On: How do you extract fields from values (Tenable data, JSON with XML tag inside)?

tlscharlie — Wed, 03 Apr 2019 20:50:40 GMT

I've got the Tenable Add-On running, and I'm ingesting vulnerability data into Splunk, which is JSON, and Splunk parses it normally and extracts all the fields I need, except for some key value pairs within a set of XML tags, which are all shown as a single value for the field.

"Field1" : "Value1", 
"Field2" : "Value2", 
"Field3" : "FieldA : \n\n
 Fielda : Valuea \n
Fieldb : Valueb \n

So Splunk will extract the JSON field value pairs until it gets to the XML tag, then it treats everything from the tag open to close as a value for "Field3". I've tried a few things with spath etc, but I'm not getting anywhere. Any obvious ideas? The field extractor errors out with an unspecific error when I try to grab anything inside the XML. I appreciate the help!

Re: Tenable Add-On: How do you extract fields from values (Tenable data, JSON with XML tag inside)?

tlscharlie — Wed, 03 Apr 2019 20:52:26 GMT

ah, i'm an idiot, the xml tags didn't show after FieldA: and the end.

topic Tenable Add-On: How do you extract fields from values (Tenable data, JSON with XML tag inside)? in All Apps and Add-ons

Tenable Add-On: How do you extract fields from values (Tenable data, JSON with XML tag inside)?

Re: Tenable Add-On: How do you extract fields from values (Tenable data, JSON with XML tag inside)?