Splunk Search

How to index perl hash data?

cblanton
Communicator

I have a the output of a Perl script as a Perl hash. I'm not able to run the script directly from Splunk, but would like to index the hashes by monitoring the location where they are saved. I tested one of the files, by trying to index it manually, but couldn't make sense of the data via the UX.

Can Splunk index a Perl hash?

As may be obvious, I don't have much experience with Perl, I just need to get the data indexed...

Tags (1)
0 Karma
1 Solution

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

View solution in original post

0 Karma

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

0 Karma

cblanton
Communicator

Thanks very much, Pavel. I'd just found the same solution with a colleague. Thanks for the confirmation that it will work!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...