topic Re: How to export events as JSON format? in Splunk Search

How to export events as JSON format?

sutom — Thu, 15 Dec 2022 14:48:48 GMT

Hi All,

I am trying to export events in JSON format, and I am able to do it, and getting events like the one below.

{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}} {"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}} {"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}

But the My expectation of having these events in an array with commas separated like the below format.

[ {"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}, {"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}, {"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}} ]

Please provide some references that can help to export events in the expected format.

Re: How to export events as JSON format?

FelixLeh — Thu, 15 Dec 2022 15:46:20 GMT

Have you tried using "KV_MODE = json" in props.conf where the corresponding Sourcetype is defined?

[your_sourcetype] KV_MODE = json #your other settings for the sourcetype:

Re: How to export events as JSON format?

yuanliu — Fri, 16 Dec 2022 06:37:28 GMT

The question is really "how to export events as JSON array." Is this correct? The result you got are a sequence of perfectly correct JSON events.

If you want all those events exported to one big array, why not put all events in one big array? Like

| stats values(_raw) as jumbo_raw

The export will then look like

{"preview":false,"result":{"_raw":[ {"tomLogs":[{"component":"tom"}]}, {"tomLogs":[{"component":"tom"}]}, {"tomLogs":[{"component":"tom"}]} ]} }

Will this array do? Otherwise you can write a simple script to convert a series of JSON objects into a JSON array.

Re: How to export events as JSON format?

VatsalJagani — Fri, 16 Dec 2022 16:14:10 GMT

@sutom - I would say the export is correct, add the [ (square brackets) and , (commas) in the exported file manually by regex replace in any advance text/code editor.

This would be the simplest option to what you want to achive. You can also write a small python script to do that we well.

I hope this helps!!!