Single field needs formatting

zeroCalm — Tue, 18 Jul 2017 22:08:19 GMT

Hello,

I am wondering is there a way to format a single field into JSON format. I have an error alert that returns the info requested, however the field "msg" is jumbled and difficult to read. However, when I take the contents of the "msg" field and plug it into a JSON converter, it is then readable.
I am very new to this, and don't have anywhere else to go. I am just wondering is there a way to format one field.

Thank you for your patience with me.

Timothy

Re: Single field needs formatting

DalJeanis — Tue, 18 Jul 2017 23:56:00 GMT

Okay, we understand your confusion. Now you have to give us the actual code (the non confidential part please) and the actual message.

But first, the spath command might be what you are looking for. It turns any properly formatted JSON into splunk variables.

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Spath

topic Single field needs formatting in Getting Data In

Single field needs formatting

Re: Single field needs formatting