All Apps and Add-ons

Collect generates extra characters to JSON output

evelenke
Contributor

Hi Splunkers,

I use command curl (Curl Command app) to poll records from JSON array. I need this data in index, so I use command collect. After indexing the JSON get additional characters - every quotation (") gets backslash (\) before. Also it adds informational text at the first raw. This brokes standard JSON into something unhandy.
Is there any way to escape this?

alt text

0 Karma

nickhills
Ultra Champion

Thats how collect works, its primaraly for summary indexing, which is why the other metadata gets added.
The \'s are added to escape the quotes, but only in _raw. As your example shows when you table response its formatted correctly.

If you want to extract the json values from the summary data use spath:
...your search|spath input=response

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...