https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/dynamic-parsing-of-json-to-fields-in-xql/m-p/1065950#M133 <P class="p1">Hi everyone,</P> <P class="p2">&nbsp;</P> <P class="p1">I’m working with a dataset in Cortex XSIAM, where I have a field containing JSON data. I want to dynamically parse this JSON so that each key becomes a field and the corresponding value is populated as its value.</P> <P class="p1">Is there a way in XQL to dynamically create columns from JSON keys without explicitly defining each key using <STRONG>alter</STRONG>?</P> <P class="p1">How can I handle future changes to the JSON structure dynamically within XQL?</P> <P class="p2">&nbsp;</P> <P class="p1">&nbsp;</P> Mon, 13 Jan 2025 13:18:32 GMT Adi-Kimhi 2025-01-13T13:18:32Z https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/dynamic-parsing-of-json-to-fields-in-xql/m-p/1065950#M133 <P class="p1">Hi everyone,</P> <P class="p2">&nbsp;</P> <P class="p1">I’m working with a dataset in Cortex XSIAM, where I have a field containing JSON data. I want to dynamically parse this JSON so that each key becomes a field and the corresponding value is populated as its value.</P> <P class="p1">Is there a way in XQL to dynamically create columns from JSON keys without explicitly defining each key using <STRONG>alter</STRONG>?</P> <P class="p1">How can I handle future changes to the JSON structure dynamically within XQL?</P> <P class="p2">&nbsp;</P> <P class="p1">&nbsp;</P> Mon, 13 Jan 2025 13:18:32 GMT https://live.paloaltonetworks.com/t5/cortex-xsiam-discussions/dynamic-parsing-of-json-to-fields-in-xql/m-p/1065950#M133 Adi-Kimhi 2025-01-13T13:18:32Z