topic Display JSON as list, not table in Getting Data In

Display JSON as list, not table

DavidB — Tue, 14 Jul 2020 01:33:24 GMT

Hi,

I'm trying to create some test data which contains some JSON embedded in it. I'm then trying to extract the JSON and display it, which is working with the following search string:

| makeresults | eval _raw="018-07-13 05:48:30.343 PDT [pool-3-thread-3] INFO STATUS - {\"well_formed_json\": \"yes\"}" | rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

However the results are displayed in a table. I'd like the results to be displayed in a list view with with color-coding, nested levels, etc.

Is this possible?

Re: Display JSON as list, not table

isoutamo — Tue, 14 Jul 2020 22:31:11 GMT

Is this what you are looking?

| makeresults 
| eval _raw="018-07-13 05:48:30.343 PDT [pool-3-thread-3]  INFO STATUS - {\"well_formed_json\": \"yes\"}" | rex field=_raw "INFO STATUS - (?<json>.*)"| rex mode=sed "s/\\\//g" | spath input=json

R. Ismo

Re: Display JSON as list, not table

DavidB — Tue, 14 Jul 2020 23:26:09 GMT

Hi Soutamo,

Thanks for the reply. Unfortunately that's not what I'm looking for. The results are still displayed in a table view.

I'm looking for the output to look like this:

Re: Display JSON as list, not table

bowesmana — Wed, 15 Jul 2020 00:31:12 GMT

The view you are showing is Splunk's raw event view - your example does not have an event as such, as it's constructed with makeresults and I don't believe you can leverage the event view without a real event

It is possible with real events inside a dashboard with the event visualisation, but I don't believe it's possible with constructed data - or for that matter with data from a lookup with inputlookup as that does not generate true events.

If you really needed this, I suspect you could construct your test data, then 'collect' it to an index and then search it with another search from that index.