I've got the Tenable Add-On running, and I'm ingesting vulnerability data into Splunk, which is JSON, and Splunk parses it normally and extracts all the fields I need, except for some key value pairs within a set of XML tags, which are all shown as a single value for the field.
"Field1" : "Value1",
"Field2" : "Value2",
"Field3" : "FieldA : \n\n
Fielda : Valuea \n
Fieldb : Valueb \n
So Splunk will extract the JSON field value pairs until it gets to the XML tag, then it treats everything from the tag open to close as a value for "Field3". I've tried a few things with spath etc, but I'm not getting anywhere. Any obvious ideas? The field extractor errors out with an unspecific error when I try to grab anything inside the XML. I appreciate the help!
ah, i'm an idiot, the xml tags didn't show after FieldA: and the end.