topic Re: XML within a JSON: How parse a raw event? in Dashboards & Visualizations

XML within a JSON: How parse a raw event?

GRamani123 — Sun, 02 Jun 2019 20:23:19 GMT

I'm trying to parse a amount value from a raw event. The event is in JSON format and one of the key value in this JSON is an xml. the field that I'm trying to parse is one of the xml tag value.
ex: event is

{"field1":"value1","field2":"value2", "field3":{"message:"

Re: XML within a JSON: How parse a raw event?

GRamani123 — Sun, 02 Jun 2019 20:29:01 GMT

{"field1":"value1","field2":"value2", "field3":{"message:"

Re: XML within a JSON: How parse a raw event?

aromanauskas — Mon, 03 Jun 2019 00:05:12 GMT

_json is a built in sourcetype which should automatically parse this event. If you are setting this to a different sourcetype then it will not parse though. Suggest you first try: | spath as this should force the json to be parsed.

Re: XML within a JSON: How parse a raw event?

GRamani123 — Mon, 03 Jun 2019 02:41:08 GMT

I'm not sure what is an issue but I complete comment is getting posted.

Re: XML within a JSON: How parse a raw event?

GRamani123 — Wed, 30 Sep 2020 00:46:41 GMT

I was able to parse the json via SPATH command and I fetched the XML in a new field. For Ex :command - Spath output=xml_field path=field3.message | table xml_field

Re: XML within a JSON: How parse a raw event?

GRamani123 — Mon, 03 Jun 2019 02:49:18 GMT

I was able to parse the xml from the event but I'm unable to fetch the value of amount from this xml. I have tried both spath and xpath.

Re: XML within a JSON: How parse a raw event?

GRamani123 — Wed, 30 Sep 2020 00:46:44 GMT

I was able to parse it by fetching xml via spath then using eval _raw=xml_field | xmlkv | table amount

Re: XML within a JSON: How parse a raw event?

aromanauskas — Mon, 03 Jun 2019 14:27:05 GMT

If you are still having an issue please post the query and example output.