All Apps and Add-ons
Highlighted

Collect generates extra characters to JSON output

Contributor

Hi Splunkers,

I use command curl (Curl Command app) to poll records from JSON array. I need this data in index, so I use command collect. After indexing the JSON get additional characters - every quotation (") gets backslash (\) before. Also it adds informational text at the first raw. This brokes standard JSON into something unhandy.
Is there any way to escape this?

alt text

0 Karma
Highlighted

Re: Collect generates extra characters to JSON output

Ultra Champion

Thats how collect works, its primaraly for summary indexing, which is why the other metadata gets added.
The \'s are added to escape the quotes, but only in _raw. As your example shows when you table response its formatted correctly.

If you want to extract the json values from the summary data use spath:
...your search|spath input=response

0 Karma