https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270040#M81265 <P>We have an application that need this information in json format. We don't have the luxury to change the logging application to log in json format.</P> Fri, 05 Feb 2016 04:17:51 GMT bharat1478 2016-02-05T04:17:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270037#M81262 <P>I have a log that looks like this (with lot more fields):</P> <PRE><CODE>04FEB2016_18:05:49.440 10789:1 INFO Struct='SListmanTskSubTranV6' IO='O' EventId=17086 Event='LISTMAN_UPDATE_FOR_EXEC_RPT REPORT' Order=1094966 To='MULT' ... </CODE></PRE> <P>I want to extract events like these from Splunk and want the output to be a <STRONG>VALID</STRONG> json object. So in this case, output should look like:</P> <PRE><CODE>{"Struct":'SListmanTskSubTranV6', "IO":'O', "EventId":17086, "Event":'LISTMAN_UPDATE_FOR_EXEC_RPT REPORT', "Order":1094966, "To":'MULT'} </CODE></PRE> <P>Is there a way to achieve this in Splunk? Our string field values can have spaces or characters like <CODE>'</CODE>, <CODE>"</CODE>, <CODE>\</CODE>, etc. in it</P> Thu, 04 Feb 2016 23:38:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270037#M81262 bharat1478 2016-02-04T23:38:14Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270038#M81263 <P>Why? Do you want to use Splunk as a log format converter!?<BR /> You can probably do that with a bunch of eval statements, but it won't be pretty.</P> Fri, 05 Feb 2016 00:13:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270038#M81263 s2_splunk 2016-02-05T00:13:11Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270039#M81264 <P>See below link for different option to export search results (including json format)</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Exportsearchresults#Choose_your_export_format">http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Exportsearchresults#Choose_your_export_format</A></P> Fri, 05 Feb 2016 03:37:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270039#M81264 somesoni2 2016-02-05T03:37:26Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270040#M81265 <P>We have an application that need this information in json format. We don't have the luxury to change the logging application to log in json format.</P> Fri, 05 Feb 2016 04:17:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270040#M81265 bharat1478 2016-02-05T04:17:51Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270041#M81266 <P>We have a python service that is using REST API to query splunk. We want to get raw data from splunk in json format even though our actual log is in key=value format. <BR /> Looks like above documentation doesn't achieve that.</P> Fri, 05 Feb 2016 04:24:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-key-value-pairs-from-my-sample-data-and-have-the/m-p/270041#M81266 bharat1478 2016-02-05T04:24:29Z