All Apps and Add-ons

xmlutils to prettyprint xml stored inside a json event?

Path Finder

I have events that are json objects. Many of those events include a field that has xml in it.
I am attempting to use xmlutils and search splunk to extract the xml value and prettyprint the xml. Is this possible?

Example event:

      "message":"Chicken SOAP response Security_Authenticate",
      "xml":"<?xml version=\"1.0\" encoding=\"UTF-8\"?><soap:Envelope xmlns:soap=\"\"><soap:Header xmlns=\"\"><Session><SessionId>04KUA1</SessionId><SequenceNumber>1</SequenceNumber><SecurityToken>18AE3J1KMCMH42FU0R9</SecurityToken></Session></soap:Header><soap:Body><Security_AuthenticateReply xmlns=\"\"><processStatus><statusCode>P</statusCode></processStatus></Security_AuthenticateReply></soap:Body></soap:Envelope>",
      "created":"2015-08-12 15:19:07.158",

I can isolate the xml for the events that have it by using this search:
index="test-mixed-json-log" | spath output=xml path=info.xml | search xml="*" | table xml

Adding xmlprettyprint to the search does not show it as pretty.

0 Karma

New Member

Love to suggest a tool which does the same I use some time to pretty print XML using

0 Karma


Hmm, I wonder if namespaces are supported. I don't know if that was ever tested.

If there is an error, you may not be seeing it, since the error itself is written to _raw.

michtek's suggestion should expose any errors, if parsing is the problem.

0 Karma


don't use "| table xml". Try to replace it with "|rename xml as _raw | xmlprettyprint"

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!