Dashboards & Visualizations

XML within a JSON: How parse a raw event?

GRamani123
New Member

I'm trying to parse a amount value from a raw event. The event is in JSON format and one of the key value in this JSON is an xml. the field that I'm trying to parse is one of the xml tag value.
ex: event is

{"field1":"value1","field2":"value2", "field3":{"message:"
Tags (3)
0 Karma

GRamani123
New Member

I was able to parse it by fetching xml via spath then using eval _raw=xml_field | xmlkv | table amount

0 Karma

aromanauskas
Path Finder

_json is a built in sourcetype which should automatically parse this event. If you are setting this to a different sourcetype then it will not parse though. Suggest you first try: | spath as this should force the json to be parsed.

0 Karma

GRamani123
New Member

I was able to parse the json via SPATH command and I fetched the XML in a new field. For Ex :command - Spath output=xml_field path=field3.message | table xml_field

0 Karma

aromanauskas
Path Finder

If you are still having an issue please post the query and example output.

0 Karma

GRamani123
New Member

I'm not sure what is an issue but I complete comment is getting posted.

0 Karma

GRamani123
New Member

I was able to parse the xml from the event but I'm unable to fetch the value of amount from this xml. I have tried both spath and xpath.

0 Karma

GRamani123
New Member

{"field1":"value1","field2":"value2", "field3":{"message:"

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...