All Apps and Add-ons

Collect generates extra characters to JSON output


Hi Splunkers,

I use command curl (Curl Command app) to poll records from JSON array. I need this data in index, so I use command collect. After indexing the JSON get additional characters - every quotation (") gets backslash (\) before. Also it adds informational text at the first raw. This brokes standard JSON into something unhandy.
Is there any way to escape this?

alt text

0 Karma

Ultra Champion

Thats how collect works, its primaraly for summary indexing, which is why the other metadata gets added.
The \'s are added to escape the quotes, but only in _raw. As your example shows when you table response its formatted correctly.

If you want to extract the json values from the summary data use spath:
...your search|spath input=response

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...