https://community.splunk.com/t5/Getting-Data-In/Need-help-with-custom-response-handler-for-REST-API-Modular/m-p/697677#M115725 <P>I found below response handler, will this work or does it require any modification? as per the sample in my original request.</P> <LI-CODE lang="markup">class ArrayHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint,oauth2=None): if response_type == "json": raw_json = json.loads(raw_response_output) column_list = [] for column in raw_json['columns']: column_list.append(column['name']) for row in raw_json['rows']: i = 0; new_event = {} for row_item in row: new_event[column_list[i]] = row_item i = i+1 print(print_xml_stream(json.dumps(new_event))) else: print_xml_stream(raw_response_output)</LI-CODE> Thu, 29 Aug 2024 09:44:14 GMT zubairsp 2024-08-29T09:44:14Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-custom-response-handler-for-REST-API-Modular/m-p/697669#M115722 <P>We have below data in json format, i need help with a custom json response handler so splunk can break every event separately. <SPAN>&nbsp;Each event starts with the&nbsp;</SPAN>record_id</P><P>{<BR />"eventData": [<BR />{<BR />"record_id": "19643",<BR />"eventID": "1179923",<BR />"loginID": "PLI",<BR />"userDN": "cn=564SD21FS8DF32A1D87FAD1F,cn=Users,dc=us,dc=oracle,dc=com",<BR />"type": "CredentialValidation",<BR />"ipAddress": "w.w.w.w",<BR />"status": "success",<BR />"accessTime": "2024-08-29T06:23:03.487Z",<BR />"oooppd": "5648sd1csd-952f-d630a41c87ed-000a3e2d",<BR />"attributekey": "User-Agent",<BR />"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"<BR />},<BR />{<BR />"record_id": "19644",<BR />"eventID": "1179924",<BR />"loginID": "OKP",<BR />"userDN": "cn=54S6DF45S212XCV6S8DF7,cn=Users,dc=us,dc=CVGH,dc=com",<BR />"type": "Logout",<BR />"ipAddress": "X.X.X.X",<BR />"status": "success",<BR />"accessTime": "2024-08-29T06:24:05.040Z",<BR />"oooppd": "54678S3D2FS962SDFV3246S8DF",<BR />"attributekey": "User-Agent",<BR />"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"<BR />}<BR />]<BR />}</P> Thu, 29 Aug 2024 07:28:02 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-custom-response-handler-for-REST-API-Modular/m-p/697669#M115722 zubairsp 2024-08-29T07:28:02Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-custom-response-handler-for-REST-API-Modular/m-p/697677#M115725 <P>I found below response handler, will this work or does it require any modification? as per the sample in my original request.</P> <LI-CODE lang="markup">class ArrayHandler: def __init__(self,**args): pass def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint,oauth2=None): if response_type == "json": raw_json = json.loads(raw_response_output) column_list = [] for column in raw_json['columns']: column_list.append(column['name']) for row in raw_json['rows']: i = 0; new_event = {} for row_item in row: new_event[column_list[i]] = row_item i = i+1 print(print_xml_stream(json.dumps(new_event))) else: print_xml_stream(raw_response_output)</LI-CODE> Thu, 29 Aug 2024 09:44:14 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-custom-response-handler-for-REST-API-Modular/m-p/697677#M115725 zubairsp 2024-08-29T09:44:14Z