Custom event viewer for records that have XML, JSON in addition to other data

tpflicke — Sat, 24 May 2014 15:37:18 GMT

I've got a large number of logs which look similar to:

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] {"metaData":{"sourceURI":"/search/" ....}}

and

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] payload=<event type="x12">...</event>

in addition to log entries with a freeform text or name-value pair load.

It the whole event was JSON then Splunk would format this nicely in the event viewer panel but this doesn't work for the above mixed entries. Changing the logs to all JSON is at present not an option.

One way seems to be creating custom events viewers that would deal with displaying above mixed events so users awkwardly end up copy-pasting payload into a JSON or XML formatter.
I hope it's possible to improve presentation of events with mixed content with limited effort, e.g. by facilitating an already existing Splunk app or deriving custom events viewers from existing ones.

What are my options?

Re: Custom event viewer for records that have XML, JSON in addition to other data

gkanapathy — Sat, 24 May 2014 23:33:32 GMT

Have you looked at a custom event renderers?

http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/EventRendering

Re: Custom event viewer for records that have XML, JSON in addition to other data

Rocket66 — Wed, 22 Oct 2014 12:45:20 GMT

"Beginning with version 6.0, Splunk Enterprise does not support the customization of event displays using event renderers"
:(

topic Re: Custom event viewer for records that have XML, JSON in addition to other data in Splunk Search

Custom event viewer for records that have XML, JSON in addition to other data

Re: Custom event viewer for records that have XML, JSON in addition to other data

Re: Custom event viewer for records that have XML, JSON in addition to other data