topic Re: Expand json messages by default in Getting Data In

Expand json messages by default?

amanteja — Tue, 08 Nov 2022 15:24:20 GMT

We have json data being fed into splunk. How can I instruct Splunk to show me the JSON object expanded by default. If default expansion is not possible can I query such that the results are expanded. Right now they are collapsed and I have to click to get to the Json fields I want

Re: Expand json messages by default

amanteja — Fri, 20 Sep 2013 03:12:11 GMT

Any way to do this? Could someone please clarify?

Re: Expand json messages by default

brentryan — Mon, 16 Dec 2013 16:38:49 GMT

Anyone ever solve this?

Re: Expand json messages by default

somesoni2 — Mon, 16 Dec 2013 18:55:17 GMT

You can use "spath" command to extract/expand all the fields in the json data. "index=xxxx sourcetype=yyyyy| spath"

Re: Expand json messages by default

brentryan — Tue, 17 Dec 2013 03:45:22 GMT

function autoExpand(){
    //console.log("autoExpand started");
    $(document).ready(function() {
        $(".Prop > a.showinline").each(function() {
            if($(this).html() == '[+]') {
                $(this)[0].click();
            }
        });
    });
    //console.log("autoExpand complete");
}

// select the target node
var target = document.body;

// create an observer instance
var observer = new MutationObserver(function(mutations) {
    autoExpand();
});

// configuration of the observer:
var config = { attributes: true, childList: true, characterData: true, subtree:true};

// pass in the target node, as well as the observer options
observer.observe(target, config);

Re: Expand json messages by default

brentryan — Tue, 17 Dec 2013 03:55:51 GMT

spath doesn't work for this. I just want to be able to view the splunk results from my queries and I don't want to click on [+] sign for every json object/array within my log just to see what's in it.

Re: Expand json messages by default

rcordova_resona — Fri, 30 Jun 2017 14:03:09 GMT

Thank you brentryan. We are on 6.x and having this issue with second level nested json keys. We did contact Splunk support, who pointed us here but could not instruct where to place this js. We do have a feature request in now (SPL-142795).

Meanwhile, for newer versions (we are on 6.x) the code below works when placed into /opt/splunk/share/splunk/search_mrsparkle/templates/pages/base.html

<script>
 function autoExpand(){
     //console.log("autoExpand started");
     $(document).ready(function() {
         $(".jsexpands").each(function() {
             if($(this).html() == '[+]') {
                 $(this)[0].click();
             }
         });
     });
     setTimeout(function(){
        $('.modalize-table-overlay').click();
      }, 500);
     //console.log("autoExpand complete");
 }
// select the target node
 var target = document.body;

 // create an observer instance
 var observer = new MutationObserver(function(mutations) {
     autoExpand();
 });

 // configuration of the observer:
 var config = { attributes: true, childList: true, characterData: true, subtree:true};

 // pass in the target node, as well as the observer options
 observer.observe(target, config);
</script>

Re: Expand json messages by default

zhatsispgx — Wed, 26 Jul 2017 18:13:44 GMT

^ this worked for me. thanks!

Re: Expand json messages by default

zhatsispgx — Wed, 26 Jul 2017 18:14:30 GMT

also note, if you want to expand json data in dashboards you will need to add this to /opt/splunk/share/splunk/search_mrsparkle/templates/pages/dashboard.html

Re: Expand json messages by default

stevesmoot — Wed, 21 Mar 2018 00:41:49 GMT

Breaks in table view though (closes a table you've expanded)

Re: Expand json messages by default

stevesmoot — Fri, 23 Mar 2018 18:53:14 GMT

Checking if [+] was found fixes the table view issue:

<script>
   function autoExpand(){
       // console.log("autoExpand started");                                                                                                                  
       var found = false;
       $(document).ready(function() {
           $(".jsexpands").each(function() {
               if($(this).html() == '[+]') {
                   found=true;
                   $(this)[0].click();
               }
           });
       });

       if (found) {setTimeout(function(){         $('.modalize-table-overlay').click();       }, 500);}
       //console.log("autoExpand complete");                                                                                                                  
   }
  // select the target node                                                                                                                                   
  var target = document.body;

  // create an observer instance                                                                                                                              
  var observer = new MutationObserver(function(mutations) {
      autoExpand();
  });

  // configuration of the observer:                                                                                                                           
  var config = { attributes: true, childList: true, characterData: true, subtree:true};

  // pass in the target node, as well as the observer options                                                                                                 
  observer.observe(target, config);
</script>

Re: Expand json messages by default

andrewzuehlke — Fri, 07 Dec 2018 14:25:55 GMT

Is there a way to apply this script to a specific app instead of on a global level?

Re: Expand json messages by default

patkujawa_wf — Fri, 14 Dec 2018 15:15:40 GMT

As a user without admin access, I settled on this client-only solution. Create a bookmarklet with this javascript (might need tweaking of the class in the future, but you can inspect the plus sign to see what it should be):

javascript:document.querySelectorAll('a.jsexpands').forEach(function(expander) {expander.click();});

Re: Expand json messages by default

andrewzuehlke — Wed, 13 Feb 2019 13:09:13 GMT

After opening a case with Splunk to find a method that will work without changing a Global setting, we settled on using this option; thanks! We made a slight modification to your JavaScript to account for multiple levels of JSON; if you are interested, the code is:

javascript:for(i=0;i<=3;i=i+1){document.querySelectorAll('a.jsexpands').forEach(function(expander) {expander.click();});}

Re: Expand json messages by default

woodcock — Mon, 06 May 2019 22:36:29 GMT

At the top of your search results are field names, above the Time field name is a paintbrush with the word Format next to it. Click on this and select All lines for the Max Lines setting and Full for the Click Selection setting. Enjoy.

Re: Expand json messages by default

D2SI — Wed, 17 Jul 2019 21:40:21 GMT

Yes, just upload it is the /appserver/static folder of your app as a *.js file after having removed '

Re: Expand json messages by default

woodcock — Wed, 17 Jul 2019 23:45:53 GMT

VERY COOL!

Re: Expand json messages by default

emceeMC — Tue, 08 Nov 2022 00:22:58 GMT

This is awesome. Thank you 🙂

Re: Expand json messages by default

rokxer — Wed, 30 Nov 2022 14:16:30 GMT

I tried on version 8.2.6.1 and it has no effect on json events. They keep being collapsed.

I am searching for a global way either, but cannot find any documentation.

Re: Expand json messages by default

SrividhyaB — Thu, 07 Dec 2023 17:26:12 GMT

Did anyone find solution for this ? The mentioned solutions doesnt seem to work