https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639074#M221435 <P>I have a user who wants to send a table resulting from | stats values() to a summary index via the collect command, but all of the logs in this summary index need to be in json format. By default, collect just separates the field-value pairs by commas. How would we format these in json before or after the collect command sends them to the summary index?</P> Thu, 06 Apr 2023 19:27:23 GMT wpb162 2023-04-06T19:27:23Z https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639074#M221435 <P>I have a user who wants to send a table resulting from | stats values() to a summary index via the collect command, but all of the logs in this summary index need to be in json format. By default, collect just separates the field-value pairs by commas. How would we format these in json before or after the collect command sends them to the summary index?</P> Thu, 06 Apr 2023 19:27:23 GMT https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639074#M221435 wpb162 2023-04-06T19:27:23Z https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639092#M221437 <P>Like this:<BR /><BR />index=_*<BR />| stats count values(sourcetype) AS sourcetype BY index<BR />| tojson<BR />| eval _time = now()<BR />| table _raw<BR />| collect index=main source="test" addtime=true testmode=true</P> Thu, 06 Apr 2023 20:36:28 GMT https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639092#M221437 woodcock 2023-04-06T20:36:28Z https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639098#M221439 <P>I appreciate your answer, and I hope to be able to use it very soon. However, we currently are running Splunk version 8.0.10, so I don't believe the tojson command is available to us.&nbsp; If there is another (probably more complicated) way to do that with our current version, that would be fantastic. Otherwise, I expect we will have to wait until we upgrade.</P> Thu, 06 Apr 2023 20:49:36 GMT https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639098#M221439 wpb162 2023-04-06T20:49:36Z https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639102#M221440 <P>8.0 line has been unsupported for 1.5 years already...</P><P>Anyway, you can try to eval a json structure using json functions <A href="https://docs.splunk.com/Documentation/Splunk/8.0.10/SearchReference/JSONFunctions" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.10/SearchReference/JSONFunctions</A></P> Thu, 06 Apr 2023 21:39:35 GMT https://community.splunk.com/t5/Splunk-Search/Convert-stats-to-JSON/m-p/639102#M221440 PickleRick 2023-04-06T21:39:35Z