Minimizing or disabling json Syntax Highlighting automatically

noahdietrich — Sat, 16 Jun 2018 11:07:23 GMT

Hello,

I have a dataset that consists of json data (using the _json sourcetype), where each event has about 30 fields and is correctly formatted and parsed by Splunk. When i do a basic search to view these events, each event shows the entire json event with syntax highlighting, taking up 30 lines of screen real-estate. I can manually minimize the json for a single event by clicking the [-] sign next to the event, or i can click "show as raw text" to fold up the event into one line, but i'd like this to be automatic for all my events.

Does anyone know if this is possible?

Essentially i can only see one event at a time, because the event shows the entire event's json (all 30 lines). I'm attaching a screenshot of what i mean here:

thank you
Noah

Re: Minimizing or disabling json Syntax Highlighting automatically

niketn — Sat, 16 Jun 2018 11:21:15 GMT

@noahdietrich, Pipe table command to your search

<yourCurrentSearch>
| table _time _raw

Also Event Viewer also has an option on top to change from default List view to Raw or Table view. This setting can also be applied by default using Role based UI Preference through ui-prefs.conf.

topic Minimizing or disabling json Syntax Highlighting automatically in Getting Data In

Minimizing or disabling json Syntax Highlighting automatically

Re: Minimizing or disabling json Syntax Highlighting automatically