Getting Data In

How to convert an event INTO JSON

kcepull2
Path Finder

[Not really a question, but wanted to document and share with the community...]

So, I had a customer that liked how JSON events showed up in the Events tab on the Search screen (e.g. colored format, collapse/expand). He wanted events that weren't JSON to show up this way, too! (I tried to explain that wasn't the purpose of this screen, but it was an interesting exercise, so what the heck....)

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

your search here
| foreach * 
    [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
| eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
| fields - jsonmv_

The resulting event(s) will be in JSON format, and will display with colors, etc. in Splunkweb.

NOTE: This is a VERY inefficient thing to do! You are basically having Splunk parse the event into fields (field extractions), then munging all those field back together into a JSON-formatted string, THEN having Splunk parse the JSON back into fields.

Like I said - an interesting exercise to see if it was possible, but not very useful in a production situation.

0 Karma
1 Solution

kcepull2
Path Finder

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

 your search here
 | foreach * 
     [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
 | eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
 | fields - jsonmv_

View solution in original post

kcepull2
Path Finder

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

 your search here
 | foreach * 
     [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
 | eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
 | fields - jsonmv_

aaraneta_splunk
Splunk Employee
Splunk Employee

Hello @kcepull2 - Thank you for sharing this question and providing a solution. Do you think you can put the solution as an answer below so it can be Accepted? That way this question doesn't look like its unanswered forever? Thanks in advance!

0 Karma

kcepull2
Path Finder

Sure! Thanks for the suggestion. 🙂

0 Karma