https://community.splunk.com/t5/Getting-Data-In/How-important-is-specified-JSON-format/m-p/612512#M105983 <P>Hello, documentation shows JSON format as a: metadata fields, events field with additional data in it.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector#Event_metadata" target="_blank" rel="noopener">Format events for HTTP Event Collector - Splunk Documentation</A></P> <P>&nbsp;</P> <P>My question is how important is to preserve this structure?&nbsp; Can you remove "event" nesting?</P> <P>That's how events looks in Splunk right now, I have to press on a "+" sign to see the actual message.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ArnasK_1-1662704176670.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21403i036A66E5C80B9DD6/image-size/medium?v=v2&amp;px=400" role="button" title="ArnasK_1-1662704176670.png" alt="ArnasK_1-1662704176670.png" /></span></P> <P>&nbsp;</P> <P>If I remove the "event" nesting I can see the main message without extra actions.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ArnasK_2-1662704319585.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21404i3DF080080767A17C/image-size/medium?v=v2&amp;px=400" role="button" title="ArnasK_2-1662704319585.png" alt="ArnasK_2-1662704319585.png" /></span></P> <P>&nbsp;</P> <P>P.S. if this is of any importance, data is being transferred to Splunk via TCP, not HTTP.</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 09 Sep 2022 07:55:47 GMT ArnasK 2022-09-09T07:55:47Z https://community.splunk.com/t5/Getting-Data-In/How-important-is-specified-JSON-format/m-p/612512#M105983 <P>Hello, documentation shows JSON format as a: metadata fields, events field with additional data in it.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/FormateventsforHTTPEventCollector#Event_metadata" target="_blank" rel="noopener">Format events for HTTP Event Collector - Splunk Documentation</A></P> <P>&nbsp;</P> <P>My question is how important is to preserve this structure?&nbsp; Can you remove "event" nesting?</P> <P>That's how events looks in Splunk right now, I have to press on a "+" sign to see the actual message.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ArnasK_1-1662704176670.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21403i036A66E5C80B9DD6/image-size/medium?v=v2&amp;px=400" role="button" title="ArnasK_1-1662704176670.png" alt="ArnasK_1-1662704176670.png" /></span></P> <P>&nbsp;</P> <P>If I remove the "event" nesting I can see the main message without extra actions.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ArnasK_2-1662704319585.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/21404i3DF080080767A17C/image-size/medium?v=v2&amp;px=400" role="button" title="ArnasK_2-1662704319585.png" alt="ArnasK_2-1662704319585.png" /></span></P> <P>&nbsp;</P> <P>P.S. if this is of any importance, data is being transferred to Splunk via TCP, not HTTP.</P> <P>&nbsp;</P> <P>&nbsp;</P> Fri, 09 Sep 2022 07:55:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-important-is-specified-JSON-format/m-p/612512#M105983 ArnasK 2022-09-09T07:55:47Z