topic Re: How to convert an event INTO JSON in Getting Data In

How to convert an event into JSON?

kcepull2 — Mon, 22 May 2023 12:48:34 GMT

[Not really a question, but wanted to document and share with the community...]

So, I had a customer that liked how JSON events showed up in the Events tab on the Search screen (e.g. colored format, collapse/expand). He wanted events that weren't JSON to show up this way, too! (I tried to explain that wasn't the purpose of this screen, but it was an interesting exercise, so what the heck....)

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

your search here
| foreach * 
    [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
| eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
| fields - jsonmv_

The resulting event(s) will be in JSON format, and will display with colors, etc. in Splunkweb.

NOTE: This is a VERY inefficient thing to do! You are basically having Splunk parse the event into fields (field extractions), then munging all those field back together into a JSON-formatted string, THEN having Splunk parse the JSON back into fields.

Like I said - an interesting exercise to see if it was possible, but not very useful in a production situation.

Re: How to convert an event INTO JSON

aaraneta_splunk — Thu, 11 May 2017 16:41:24 GMT

Hello @kcepull2 - Thank you for sharing this question and providing a solution. Do you think you can put the solution as an answer below so it can be Accepted? That way this question doesn't look like its unanswered forever? Thanks in advance!

Re: How to convert an event INTO JSON

kcepull2 — Thu, 11 May 2017 18:32:36 GMT

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

 your search here
 | foreach * 
     [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
 | eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
 | fields - jsonmv_

Re: How to convert an event INTO JSON

kcepull2 — Thu, 11 May 2017 18:32:59 GMT

Sure! Thanks for the suggestion. 🙂

Re: How to convert an event INTO JSON

damode1 — Mon, 22 May 2023 00:40:56 GMT

getting below error when I tried your spl

Failed to parse templatized search for field 'tag::eventtype'