convert data in string format to json

AnilPujar — Mon, 24 Jul 2023 08:19:13 GMT

is there any function available in splunk which converts the data in string format to json, which is actually json data but missing quotations.

{uiType:Picker,model:{type:field,name:options_for_teams},plainTextMessage:Please select an option from the below list.,uiMetadata:{label:Please select an option from the below list.,itemType:ID,style:list,options:[{label:Create Service Request,value:Create Service Request,renderStyle:data,enabled:false},{label:Report an Incident,value:Report an Incident,renderStyle:data,enabled:false},{label:Check Incident/Request Status,value:Check Incident/Request Status,renderStyle:data,enabled:false},{label:Self-Service Knowledge Article,value:Self-Service Knowledge Article,renderStyle:data,enabled:false},{label:Submit your pending surveys,value:Submit your pending surveys,renderStyle:data,enabled:false},{label:Chat with Live Agent,value:Chat with Live Agent,renderStyle:data,enabled:false},{label:My Pending Approvals,value:My Pending Approvals,renderStyle:data,enabled:false},{label:Password Reset,value:Password Reset,renderStyle:data,enabled:false},{label:View My Assets,value:View My Assets,renderStyle:data,enabled:false},{label:Create An Emergency Change,value:Create An Emergency Change,renderStyle:data,enabled:false}],multiSelect:false,openByDefault:true,required:true,maskType:NONE,totalOptionsCount:10,totalSearchResultsCount:0,paginationBreak:-1},nluTextEnabled:false,value:View My Assets}

added the payload string for reference.

since this payload is in string format, i'm unable to use spath command.

Re: convert data in string format to json

ITWhisperer — Mon, 24 Jul 2023 09:57:17 GMT

Try something like this - it appears to work with the example given

| rex mode=sed "s/(?<delimiter>[\{,\[]+)?(?<key>\w+):(?<value>([\{\[]+|[^,\}]+))(?<close>[\}\],]+)?/\1\"\2\":\"\4\"\5/g s/\"(?<opening>[{\[]+)\"/\1/g"

Re: convert data in string format to json

ITWhisperer — Mon, 24 Jul 2023 09:57:55 GMT

Having said that, you may want to extend it to unquote the numerics

Re: convert data in string format to json

AnilPujar — Mon, 24 Jul 2023 10:04:57 GMT

@ITWhisperer Thanks this helped at a certain level, it's adding quotations in some payload data where it contains URLs.

Thank you very much 🙂

topic convert data in string format to json in Splunk Search

convert data in string format to json

Re: convert data in string format to json

Re: convert data in string format to json

Re: convert data in string format to json