Getting Data In

How can I view JSON events in structured view and "normal" list style

shawngardner
New Member

My events are application log events (logback in Java) a la INFO [2016-07-07 20:56:54,937] [service: catalog-service] [visitorId: a3b2ced84dfa] com.blah.blergh.SomeClass: Something log-worthy happened which often contain stack traces.

Currently, we are ingesting these logs with the log4j sourcetype and extracting interesting fields while preserving the useful ability to watch streaming logs in a way that is easy to scan visually. The problem we run into is that extracting useful information about the stack traces has involved a set of nasty regexes that only work most of the time.

I have been testing writing these logs and ingesting them as JSON events. This gives us the very nice property of easily searchable/reportable stack trace information without regexes and a useful structured view of the events - the default collapsible view.

The one thing that our original solution had that our new one does not is an ability to see a list of events that is easy to visually scan. I'd like to create another view that will automatically format the results either into a table or pre-defined concatenation of JSON fields. Obviously I can format the results any way I want on any search, but I'd like to make this format standard so not every user watching these logs needs to format the events in the search string.

Is there a good way to solve this remaining use case without double-ingesting?

0 Karma

ryanoconnor
Builder

Have you looked at the spath command? That is a useful tool for parsing JSON events. It might make sense to use this to create some searches and give them a specific Dashboard to look at if you're OK with that route?

0 Karma

shawngardner
New Member

Spath is probably what I'd use to format the display, the problem is that I need to enable ad-hoc searches instead of a set of pre-canned searches.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...