Apply the xml_to_object and object_to_xml functions to pipelines

The xml_to_object and object_to_xml functions are both conversion functions that are available for both the Edge Processor solution and the Ingest Processor solution. Use these functions to convert the format of your pipeline data between XML strings and JSON objects. These functions are not supported in Splunk searches.

Use the xml_to_object function

Use the xml_to_object function to convert an XML string format into a JSON object. The JSON format makes your data easier to manipulate and modify, and increases the efficiency to store and query from Splunk indexes.

Use your Ingestion Processor solution editor to apply this function.

The xml_to_object function takes an XML string and parses it into an object. It returns null if the string cannot be parsed into XML. You can also set the xml_to_object function to infer the data types within your XML string. It can infer booleans, integers, floats, and recognizes the value null. See the following syntax:
function xml_to_object(
    $value: string, 
    $infer_types: boolean = <select a value>): object
See the following examples:
If the XML string passed into the xml_to_object function were the following:
<?xml version='1.0' encoding='utf-8'?>
<Publisher Name="Random House">
    <Author>
        <Name Prefix="Mr.">Bob Jones</Name>
        <Books>
            <Fiction>The Salt Flats</Fiction>
            <NonFiction>Guide to Birds</NonFiction>
            <Fiction>The Great Jablowski</Fiction>
        </Books>
        <Biography>Bob is an <em>amazing</em> author!</Biography>
    </Author>
</Publisher>
This would be the outputted object:
{
    "Publisher": {
        "@Name": "Random House",
        "Author": {
            // Note how the mixed content is broken up.
            "Biography": {
                "em": "amazing",
                "$": [
                    "Bob is an ",
                    " author!"
                ]
            },
            "Books": {
                // Note that the values in the array are flat values
                "Fiction": [
                    "The Salt Flats",
                    "The Great Jablowski"
                ],
                // Note that the value is a flat value
                "NonFiction": "Guide to Birds"
            },
            "Name": {
                "@Prefix": "Mr."
                "$": "Bob Jones"
            },
        }
    }
}
As another example, if the XML string passed into the xml_object_function were the following:
<?xml version='1.0' encoding='utf-8'?>
<Bookstore Location="Downtown">
    <Book ISBN="978-0321765723">
        <Title>The Hitchhiker's Guide to the Galaxy</Title>
        <Author>Douglas Adams</Author>
        <Price Currency="USD">12.99</Price>
        <Description>A <emphasis>hilarious</emphasis> science fiction classic.</Description>
    </Book>
    <Book ISBN="978-0743273565">
        <Title>The Great Gatsby</Title>
        <Author>F. Scott Fitzgerald</Author>
        <Price Currency="USD">9.50</Price>
    </Book>
    <Staff>
        <Employee ID="E001">Alice Smith</Employee>
        <Employee ID="E002">Bob Johnson</Employee>
    </Staff>
</Bookstore>
This would be the outputted object:
{
    "Bookstore": {
        "@Location": "Downtown",
        "Book": [
            {
                "@ISBN": "978-0321765723",
                "Title": "The Hitchhiker's Guide to the Galaxy",
                "Author": "Douglas Adams",
                "Price": {
                    "@Currency": "USD",
                    "$": "12.99"
                },
                "Description": {
                    "emphasis": "hilarious",
                    "$": [
                        "A ",
                        " science fiction classic."
                    ]
                }
            },
            {
                "@ISBN": "978-0743273565",
                "Title": "The Great Gatsby",
                "Author": "F. Scott Fitzgerald",
                "Price": {
                    "@Currency": "USD",
                    "$": "9.50"
                }
            }
        ],
        "Staff": {
            "Employee": [
                {
                    "@ID": "E001",
                    "$": "Alice Smith"
                },
                {
                    "@ID": "E002",
                    "$": "Bob Johnson"
                }
            ]
        }
    }
}

Use the object_to_xml function

Use the object_to_xml function to convert data that is formatted as a JSON object to XML format. You can use this function to return your data to its original format after turning it to JSON.

Use your Ingestion Processor solution editor to apply this function.

This function takes a JSON-formatted object in the format above and converts it to an XML string. See the following syntax:
function object_to_xml($object: object): string
For example, if the JSON object passed into the object_to_xml function were the following:
{
    "Publisher": {
        "@Name": "Random House",
        "Author": {
            // Note how the mixed content is broken up.
            "Biography": {
                "em": "amazing",
                "$": [
                    "Bob is an ",
                    " author!"
                ]
            },
            "Books": {
                // Note that the values in the array are flat values
                "Fiction": [
                    "The Salt Flats",
                    "The Great Jablowski"
                ],
                // Note that the value is a flat value
                "NonFiction": "Guide to Birds"
            },
            "Name": {
                "@Prefix": "Mr."
                "$": "Bob Jones"
            },
        }
    }
}
This would be the outputted XML string:
<?xml version='1.0' encoding='UTF-8'?>
<Publisher Name="Random House">
    <Author>
        <Name Prefix="Mr.">Bob Jones</Name>
        <Books>
            <Fiction>The Salt Flats</Fiction>
            <NonFiction>Guide to Birds</NonFiction>
            <Fiction>The Great Jablowski</Fiction>
        </Books>
        <Biography>Bob is an <em>amazing</em> author!</Biography>
    </Author>
</Publisher>
As another example, if the JSON object passed into the object_to_xml function were the following:
{
    "Bookstore": {
        "@Location": "Downtown",
        "Book": [
            {
                "@ISBN": "978-0321765723",
                "Title": "The Hitchhiker's Guide to the Galaxy",
                "Author": "Douglas Adams",
                "Price": {
                    "@Currency": "USD",
                    "$": "12.99"
                },
                "Description": {
                    "emphasis": "hilarious",
                    "$": [
                        "A ",
                        " science fiction classic."
                    ]
                }
            },
            {
                "@ISBN": "978-0743273565",
                "Title": "The Great Gatsby",
                "Author": "F. Scott Fitzgerald",
                "Price": {
                    "@Currency": "USD",
                    "$": "9.50"
                }
            }
        ],
        "Staff": {
            "Employee": [
                {
                    "@ID": "E001",
                    "$": "Alice Smith"
                },
                {
                    "@ID": "E002",
                    "$": "Bob Johnson"
                }
            ]
        }
    }
}
This would be the outputted XML string:
<?xml version='1.0' encoding='UTF-8'?>
<Bookstore Location="Downtown">
    <Book ISBN="978-0321765723">
        <Title>The Hitchhiker's Guide to the Galaxy</Title>
        <Author>Douglas Adams</Author>
        <Price Currency="USD">12.99</Price>
        <Description>A <emphasis>hilarious</emphasis> science fiction classic.</Description>
    </Book>
    <Book ISBN="978-0743273565">
        <Title>The Great Gatsby</Title>
        <Author>F. Scott Fitzgerald</Author>
        <Price Currency="USD">9.50</Price>
    </Book>
    <Staff>
        <Employee ID="E001">Alice Smith</Employee>
        <Employee ID="E002">Bob Johnson</Employee>
    </Staff>
</Bookstore>