topic Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields in Getting Data In

my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

DataOrg — Mon, 06 Apr 2020 06:45:14 GMT

I have python script configured in the HF , the script output are enclosed with unicode character U' in the output so splunk is unable to parse the fields properly.

script output:

{u'rows': [{u'timestamp': 1585924500001L, u'RAM_': 1000, u'Allocated': 4000.78, u'queue': 0, u'Details':  u'Connected': 2, u'Queue': 0, u'EventsQueue': 0}]

I had include in Props.conf for charset but still it was not parsing properly.

props.conf
[sourcetype::GetStreamData]
CHARSET=utf-8

[sourcetype::GetStreamData]
CHARSET=utf-8

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

kamlesh_vaghela — Mon, 06 Apr 2020 07:11:12 GMT

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

DataOrg — Mon, 06 Apr 2020 08:45:26 GMT

@kamlesh_vaghela
this is the code which i am using.

import requests
import json

headers={
        "accept": "application/json",
        "content-type": "application/json"
    }

test_urls = ['https://google.com']


def return_json(url):
    try:
        response = requests.get(url,headers=headers)

        # Consider any status other than 2xx an error
        if not response.status_code // 100 == 2:
            return "Error: Unexpected response {}".format(response)

        json_obj = response.json()
        return json_obj
    except requests.exceptions.RequestException as e:
        # A serious problem happened, like an SSLError or InvalidURL
        return "Error: {}".format(e)


for url in test_urls:

    print "Fetching URL '{}'".format(url)
    print return_json(url)

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

kamlesh_vaghela — Mon, 06 Apr 2020 09:00:15 GMT

@premranjithj

Can you please replace return json_obj with return json.dump(json_obj) and try ?

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

DataOrg — Mon, 06 Apr 2020 10:28:06 GMT

@kamlesh_vaghela thanks , it worked with dumps.
Please convert it into answer to accept it