Dashboards & Visualizations

XML within a JSON: How parse a raw event?

GRamani123
New Member

I'm trying to parse a amount value from a raw event. The event is in JSON format and one of the key value in this JSON is an xml. the field that I'm trying to parse is one of the xml tag value.
ex: event is

{"field1":"value1","field2":"value2", "field3":{"message:"
Tags (3)
0 Karma

GRamani123
New Member

I was able to parse it by fetching xml via spath then using eval _raw=xml_field | xmlkv | table amount

0 Karma

aromanauskas
Path Finder

_json is a built in sourcetype which should automatically parse this event. If you are setting this to a different sourcetype then it will not parse though. Suggest you first try: | spath as this should force the json to be parsed.

0 Karma

GRamani123
New Member

I was able to parse the json via SPATH command and I fetched the XML in a new field. For Ex :command - Spath output=xml_field path=field3.message | table xml_field

0 Karma

aromanauskas
Path Finder

If you are still having an issue please post the query and example output.

0 Karma

GRamani123
New Member

I'm not sure what is an issue but I complete comment is getting posted.

0 Karma

GRamani123
New Member

I was able to parse the xml from the event but I'm unable to fetch the value of amount from this xml. I have tried both spath and xpath.

0 Karma

GRamani123
New Member

{"field1":"value1","field2":"value2", "field3":{"message:"

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...