https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249058#M47937 <P>My events are application log events (logback in Java) a la <CODE>INFO [2016-07-07 20:56:54,937] [service: catalog-service] [visitorId: a3b2ced84dfa] com.blah.blergh.SomeClass: Something log-worthy happened</CODE> which often contain stack traces.</P> <P>Currently, we are ingesting these logs with the log4j sourcetype and extracting interesting fields while preserving the useful ability to watch streaming logs in a way that is easy to scan visually. The problem we run into is that extracting useful information about the stack traces has involved a set of nasty regexes that only work <EM>most</EM> of the time.</P> <P>I have been testing writing these logs and ingesting them as JSON events. This gives us the very nice property of easily searchable/reportable stack trace information without regexes and a useful structured view of the events - the default collapsible view.</P> <P>The one thing that our original solution had that our new one does not is an ability to see a list of events that is easy to visually scan. I'd like to create another view that will automatically format the results either into a table or pre-defined concatenation of JSON fields. Obviously I can format the results any way I want on any search, but I'd like to make this format standard so not every user watching these logs needs to format the events in the search string.</P> <P>Is there a good way to solve this remaining use case without double-ingesting?</P> Fri, 08 Jul 2016 01:12:45 GMT shawngardner 2016-07-08T01:12:45Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249058#M47937 <P>My events are application log events (logback in Java) a la <CODE>INFO [2016-07-07 20:56:54,937] [service: catalog-service] [visitorId: a3b2ced84dfa] com.blah.blergh.SomeClass: Something log-worthy happened</CODE> which often contain stack traces.</P> <P>Currently, we are ingesting these logs with the log4j sourcetype and extracting interesting fields while preserving the useful ability to watch streaming logs in a way that is easy to scan visually. The problem we run into is that extracting useful information about the stack traces has involved a set of nasty regexes that only work <EM>most</EM> of the time.</P> <P>I have been testing writing these logs and ingesting them as JSON events. This gives us the very nice property of easily searchable/reportable stack trace information without regexes and a useful structured view of the events - the default collapsible view.</P> <P>The one thing that our original solution had that our new one does not is an ability to see a list of events that is easy to visually scan. I'd like to create another view that will automatically format the results either into a table or pre-defined concatenation of JSON fields. Obviously I can format the results any way I want on any search, but I'd like to make this format standard so not every user watching these logs needs to format the events in the search string.</P> <P>Is there a good way to solve this remaining use case without double-ingesting?</P> Fri, 08 Jul 2016 01:12:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249058#M47937 shawngardner 2016-07-08T01:12:45Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249059#M47938 <P>Have you looked at the spath command? That is a useful tool for parsing JSON events. It might make sense to use this to create some searches and give them a specific Dashboard to look at if you're OK with that route? </P> Fri, 08 Jul 2016 12:28:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249059#M47938 ryanoconnor 2016-07-08T12:28:41Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249060#M47939 <P>Spath is probably what I'd use to format the display, the problem is that I need to enable ad-hoc searches instead of a set of pre-canned searches.</P> Fri, 08 Jul 2016 15:46:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-view-JSON-events-in-structured-view-and-quot-normal/m-p/249060#M47939 shawngardner 2016-07-08T15:46:35Z