Getting Data In

Expand json messages by default?

amanteja
Path Finder

We have json data being fed into splunk. How can I instruct Splunk to show me the JSON object expanded by default. If default expansion is not possible can I query such that the results are expanded. Right now they are collapsed and I have to click to get to the Json fields I want

Labels (1)
Tags (2)

woodcock
Esteemed Legend

At the top of your search results are field names, above the Time field name is a paintbrush with the word Format next to it. Click on this and select All lines for the Max Lines setting and Full for the Click Selection setting. Enjoy.

0 Karma

rokxer
Engager

I tried on version 8.2.6.1 and it has no effect on json events. They keep being collapsed.

I am searching for a global way either, but cannot find any documentation.

SrividhyaB
Engager

Did anyone find solution for this ? The mentioned solutions doesnt seem to work

0 Karma

patkujawa_wf
Engager

As a user without admin access, I settled on this client-only solution. Create a bookmarklet with this javascript (might need tweaking of the class in the future, but you can inspect the plus sign to see what it should be):

javascript:document.querySelectorAll('a.jsexpands').forEach(function(expander) {expander.click();});

chrome dev tools focused on the plus sign

emceeMC
Engager

This is awesome. Thank you 🙂 

0 Karma

andrewzuehlke
Explorer

After opening a case with Splunk to find a method that will work without changing a Global setting, we settled on using this option; thanks! We made a slight modification to your JavaScript to account for multiple levels of JSON; if you are interested, the code is:

javascript:for(i=0;i<=3;i=i+1){document.querySelectorAll('a.jsexpands').forEach(function(expander) {expander.click();});}

woodcock
Esteemed Legend

VERY COOL!

0 Karma

stevesmoot
Explorer

Checking if [+] was found fixes the table view issue:

<script>
   function autoExpand(){
       // console.log("autoExpand started");                                                                                                                  
       var found = false;
       $(document).ready(function() {
           $(".jsexpands").each(function() {
               if($(this).html() == '[+]') {
                   found=true;
                   $(this)[0].click();
               }
           });
       });

       if (found) {setTimeout(function(){         $('.modalize-table-overlay').click();       }, 500);}
       //console.log("autoExpand complete");                                                                                                                  
   }
  // select the target node                                                                                                                                   
  var target = document.body;

  // create an observer instance                                                                                                                              
  var observer = new MutationObserver(function(mutations) {
      autoExpand();
  });

  // configuration of the observer:                                                                                                                           
  var config = { attributes: true, childList: true, characterData: true, subtree:true};

  // pass in the target node, as well as the observer options                                                                                                 
  observer.observe(target, config);
</script>

andrewzuehlke
Explorer

Is there a way to apply this script to a specific app instead of on a global level?

0 Karma

D2SI
Communicator

Yes, just upload it is the /appserver/static folder of your app as a *.js file after having removed '

0 Karma

stevesmoot
Explorer

Breaks in table view though (closes a table you've expanded)

0 Karma

brentryan
Explorer

spath doesn't work for this. I just want to be able to view the splunk results from my queries and I don't want to click on [+] sign for every json object/array within my log just to see what's in it.

brentryan
Explorer
function autoExpand(){
    //console.log("autoExpand started");
    $(document).ready(function() {
        $(".Prop > a.showinline").each(function() {
            if($(this).html() == '[+]') {
                $(this)[0].click();
            }
        });
    });
    //console.log("autoExpand complete");
}

// select the target node
var target = document.body;

// create an observer instance
var observer = new MutationObserver(function(mutations) {
    autoExpand();
});

// configuration of the observer:
var config = { attributes: true, childList: true, characterData: true, subtree:true};

// pass in the target node, as well as the observer options
observer.observe(target, config);

rcordova_resona
Engager

Thank you brentryan. We are on 6.x and having this issue with second level nested json keys. We did contact Splunk support, who pointed us here but could not instruct where to place this js. We do have a feature request in now (SPL-142795).

Meanwhile, for newer versions (we are on 6.x) the code below works when placed into /opt/splunk/share/splunk/search_mrsparkle/templates/pages/base.html

<script>
 function autoExpand(){
     //console.log("autoExpand started");
     $(document).ready(function() {
         $(".jsexpands").each(function() {
             if($(this).html() == '[+]') {
                 $(this)[0].click();
             }
         });
     });
     setTimeout(function(){
        $('.modalize-table-overlay').click();
      }, 500);
     //console.log("autoExpand complete");
 }
// select the target node
 var target = document.body;

 // create an observer instance
 var observer = new MutationObserver(function(mutations) {
     autoExpand();
 });

 // configuration of the observer:
 var config = { attributes: true, childList: true, characterData: true, subtree:true};

 // pass in the target node, as well as the observer options
 observer.observe(target, config);
</script>
0 Karma

zhatsispgx
Path Finder

^ this worked for me. thanks!

0 Karma

zhatsispgx
Path Finder

also note, if you want to expand json data in dashboards you will need to add this to /opt/splunk/share/splunk/search_mrsparkle/templates/pages/dashboard.html

0 Karma

somesoni2
Revered Legend

You can use "spath" command to extract/expand all the fields in the json data. "index=xxxx sourcetype=yyyyy| spath"

0 Karma

brentryan
Explorer

Anyone ever solve this?

0 Karma

amanteja
Path Finder

Any way to do this? Could someone please clarify?

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...