XML Processing Help

Hey, if I have an event that is coming into Crible Stream, with format of “<?xml version="1.0" encoding="UTF-8"?>” how would I convert the event to JSON?
I see the use of C.Text.parseXml(_raw, false), but that doesnt seem to parse it properly for me. Maybe I’m doing it wrong, but it doesnt seem to get parsed. How would I do that? Tools such as NiFi can convert from XML to JSON easily and quickly, but this seems a bit harder.

Can you share a sanitized or stripped down example XML you’re having trouble parsing? Does each event start with <?xml> tag, or a file with multiple events?

@eugene its similar to McAfee HBSS data such as:

<?xml version="1.0" encoding="UTF-8"?>
        <AgentGUID>GUID HERE</AgentGUID>
        <OSName>Windows 8 Workstation</OSName>
    <SCORSoftware ProductName="Solidifier" ProductVersion="" ProductFamily="Secure">
            <SCORend_time>Sun Nov 21 2000 12:31:56</SCORend_time>

This setup worked for me. Can you check where yours differs?

@eugene It looks like that works. Thanks. That helps. Would be nice to have that included in the official documentation

Glad it helped! Please mark the answer as the Solution when you have a chance.

I’ll talk to the docs team about making an update. What was the new insight you gained from my answer? How was it different from what you were trying to do?

@eugene the documentation Reducing Windows XML Events | Cribl Docs shows that it can be run like: C.Text.parseXml(_raw, false) so with 2 variables not 1 in the parenthesis. C.Text.parseXml(_raw, false) , which is different than what worked of C.Text.parseXml(_raw)

1 UpGoat

Strange. With the sample you shared, C.Text.parseXml(_raw,false) works (as does true) just as well for me. I wonder if something else.