All Apps and Add-ons

Collect generates extra characters to JSON output

evelenke
Contributor

Hi Splunkers,

I use command curl (Curl Command app) to poll records from JSON array. I need this data in index, so I use command collect. After indexing the JSON get additional characters - every quotation (") gets backslash (\) before. Also it adds informational text at the first raw. This brokes standard JSON into something unhandy.
Is there any way to escape this?

alt text

0 Karma

nickhills
Ultra Champion

Thats how collect works, its primaraly for summary indexing, which is why the other metadata gets added.
The \'s are added to escape the quotes, but only in _raw. As your example shows when you table response its formatted correctly.

If you want to extract the json values from the summary data use spath:
...your search|spath input=response

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...