Display JSON as list, not table

[DavidB]

Hi,

I'm trying to create some test data which contains some JSON embedded in it. I'm then trying to extract the JSON and display it, which is working with the following search string:

| makeresults | eval _raw="018-07-13 05:48:30.343 PDT [pool-3-thread-3]  INFO STATUS - {\"well_formed_json\": \"yes\"}"
| rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

However the results are displayed in a table. I'd like the results to be displayed in a list view with with color-coding,  nested levels, etc.

Is this possible? 

[isoutamo]

Hi

Is this what you are looking?

| makeresults 
| eval _raw="018-07-13 05:48:30.343 PDT [pool-3-thread-3]  INFO STATUS - {\"well_formed_json\": \"yes\"}" | rex field=_raw "INFO STATUS - (?<json>.*)"| rex mode=sed "s/\\\//g" | spath input=json

R. Ismo 

[DavidB]

Hi Soutamo,

Thanks for the reply. Unfortunately that's not what I'm looking for. The results are still displayed in a table view.

I'm looking for the output to look like this:

[bowesmana]

The view you are showing is Splunk's raw event view - your example does not have an event as such, as it's constructed with makeresults and I don't believe you can leverage the event view without a real event

It is possible with real events inside a dashboard with the event visualisation, but I don't believe it's possible with constructed data - or for that matter with data from a lookup with inputlookup as that does not generate true events.

If you really needed this, I suspect you could construct your test data, then 'collect' it to an index and then search it with another search from that index.