using outputMode JSON and using multivalued fields in the REST API

sideview — Mon, 28 Sep 2020 14:26:27 GMT

Does anyone know any way to tickle outputMode json in the Splunk REST API, such that it will actually give back multivalue field values, appropriately separated?

OutputMode XML divides up the individual values nicely. Here's what you get for a single result row (coming off index=_internal group="per_*_thruput" | head 1000 | stats values(group) as group)

<result offset="0">
  <field k="groups">
    <value>
      <text>per_host_thruput</text>
    </value>
    <value>
      <text>per_index_thruput</text>
    </value>
    <value>
      <text>per_source_thruput</text>
    </value>
    <value>
      <text>per_sourcetype_thruput</text>
    </value>
  </field>
</result>

(indentation added)

but outputMode json just joins the values together on space and gives back a giant string...

[{"groups": "per_host_thruput per_index_thruput per_source_thruput per_sourcetype_thruput"}]

Which seriously limits my options. (If I knew that the values didn't themselves contain spaces then I could split on space, but this is framework code and that's not an option)

Apparently there's an outputmode=json_cols, at least in 5.0 and up. And the same results in that mode are:

{
"preview":false,
"init_offset":0,
"messages":[
    {"type":"DEBUG","text":"base lispy: [ AND index::_internal per source::*metrics.log thruput ]"},
    {"type":"DEBUG","text":"search context: user=\"admin\", app=\"sideview_utils\", bs-pathname=\"C:\\Program Files\\Splunk\\etc\""}
  ],
"fields":["groups"],
"columns":[
    [
      ["per_host_thruput","per_index_thruput","per_source_thruput","per_sourcetype_thruput"]
    ]
  ]
}

(indentation added)

As you can see, it does split up the multivalue values nicely. However when you use this outputMode on SplunkWeb, the server still sends back content type of text/xml, which of course triggers parse errors in any client that pays attention to the response headers... Which doesn't give a lot of confidence.

So is there any known workaround here for someone wanting to use the REST API and wanting to rretrieve multivalue field values?
Is json_cols considered a better and more stable outputmode then outputMode json or is json_cols still experimental? I dont want to port all my code to use a new outputformat just for this, if that new outputformat isn't fully baked or supported.

Re: using outputMode JSON and using multivalued fields in the REST API

Stephen_Sorkin — Fri, 26 Jul 2013 18:29:04 GMT

json_cols is a well supported output mode, and the one that's used by our Highchart based charting library. We'd consider it a bug that we're reporting the wrong content type.

The plain JSON output is being fixed to emit proper multivalued fields, but you can be confident in your use of json_cols.

topic Re: using outputMode JSON and using multivalued fields in the REST API in Getting Data In

using outputMode JSON and using multivalued fields in the REST API

Re: using outputMode JSON and using multivalued fields in the REST API