topic Json field not extracted in Splunk DB Connect Input via SQL Server : using Splunk DB Connect 2.0 in Getting Data In

Json field not extracted in Splunk DB Connect Input via SQL Server : using Splunk DB Connect 2.0

zanjani786 — Mon, 08 Apr 2019 18:17:17 GMT

i have made an INPUT Field through MS SQL SERVER, There is a column in my table which has JSON values, SPLUNK DB Connect is not showing this json value in any of it's event or fields. it is showing only '{' in the JSON field.
Please help n guide me to resolve this issue or parse the json key, values in to the new column.
Thanks,

Re: Json field not extracted in Splunk DB Connect Input via SQL Server : using Splunk DB Connect 2.0

grittonc — Tue, 09 Apr 2019 12:53:10 GMT

What sourcetype are you using?

Re: Json field not extracted in Splunk DB Connect Input via SQL Server : using Splunk DB Connect 2.0

zanjani786 — Wed, 10 Apr 2019 11:00:29 GMT

i have connection with MS-SQL Server in my input database. and gave my source type an anonymous name

Re: Json field not extracted in Splunk DB Connect Input via SQL Server : using Splunk DB Connect 2.0

popalzie — Wed, 30 Sep 2020 04:21:34 GMT

Was there ever a solution found for this issue? I am facing the same problem where the datatype I am returning from the database is of type JSON and being inputed using DBX. In Splunk, however, the field just shows as "{". Example below:

json_returned_from_db="{"id":1234}"

The value here is being treated as a String and so the first 2 double quotes encompasess the { and that is what is returned in the field in Splunk.

I want it to return the result as a JSON type preferably.

Thanks!