Getting Data In
Highlighted

Export results to a file gives Invalid Json file

Communicator

When I export my results to a JSON file and then try to validate it with jsonlint.com I get an EOF error.

Is there an option I can add in my search or conf file I can change so when it exports the file in JSON format it saves the file as 1 big JSON file instead of treating each line as being valid JSON?

Here is the error I get when trying to validate it.

Parse error on line 7:
...ceId)": "87"    }}{    "preview": fal
---------------------^
Expecting 'EOF', '}', ',', ']'

Here is my a sample of my data.

{"preview":false,"result":{"_time":"2014-04-01T20:00:00.000-0500","dc(mobileDeviceId)":"87"}}
{"preview":false,"result":{"_time":"2014-04-01T21:00:00.000-0500","dc(mobileDeviceId)":"78"}}
{"preview":false,"result":{"_time":"2014-04-01T22:00:00.000-0500","dc(mobileDeviceId)":"69"}}
{"preview":false,"lastrow":true,"result":{"_time":"2014-04-01T23:00:00.000-0500","dc(mobileDeviceId)":"44"}}

Here is what the exported file should look like in order for it to be valid JSON.( [] around the whole thing and commas at the end of every line)

[{"preview":false,"result":{"_time":"2014-04-01T20:00:00.000-0500","dc(mobileDeviceId)":"87"}},
{"preview":false,"result":{"_time":"2014-04-01T21:00:00.000-0500","dc(mobileDeviceId)":"78"}},
{"preview":false,"result":{"_time":"2014-04-01T22:00:00.000-0500","dc(mobileDeviceId)":"69"}},
{"preview":false,"lastrow":true,"result":{"_time":"2014-04-01T23:00:00.000-0500","dc(mobileDeviceId)":"44"}}]
Tags (4)
Highlighted

Re: Export results to a file gives Invalid Json file

SplunkTrust
SplunkTrust

You could run this to convert it after the fact:

sed -e '1s/^/[/; s/}}$/}},/g; $s/,$/]/' input > output

Some background on why you're getting what you're getting: http://answers.splunk.com/answers/65932/rest-api-json-invalid-format

View solution in original post

Highlighted

Re: Export results to a file gives Invalid Json file

Communicator

Yeah I understand I can just format the data after I have saved the file but that isn't the point. I shouldn't have to. Thanks for the link. That is one I had already ran across while trying to find a solution to my problem. That's fine and makes sense why each line they send is valid JSON if I was using the API to get results but since I am exporting my results from the GUI I am always going to get all my results at once because you can't export until the search has finished.

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

SplunkTrust
SplunkTrust

That link is relevant to your question because the export button does call the export REST endpoint.

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

Communicator

So basically what you are saying is there isn't a way to have it do what I want? 😞

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

SplunkTrust
SplunkTrust

There's always a way. How to get there depends on where you want to get to.

You're exporting JSON data, and would like to have each event included in a large array instead of as its own JSON document. What's the bigger picture?

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

Communicator

I am then using that exported data to populate data points on a different system that is using some D3 charting.

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

SplunkTrust
SplunkTrust

Okay - is that different system going to pull data automatically or will you be moving data manually only?

Side note - you can do D3-based charting in Splunk as well.

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

Communicator

I will be manually moving it for the time being while we are experimenting with different D3 charts. Eventually in the long run we would like to have the other system just use the Splunk API to request the data but we didn't want to go through the hassle of setting that up yet. We thought we would just export the data and have the other system look at the JSON file and load it in.

0 Karma
Highlighted

Re: Export results to a file gives Invalid Json file

Communicator

-Char limit in previous comment-

I know Splunk can do D3 charting as well but I haven't had the time to experiment with it at all yet or learn to use it and the developer I am working with hasn't touched Splunk before so he didn't have the time to get up to speed with it at this time but knew how to load info from a JSON file and display it through D3 on a webpage. So not knowing that Splunk exports JSON files the way it does we thought this way would be the easiest/quickest way to experiment with some data in D3.

0 Karma