How to convert an event into JSON?

[kcepull2]

[Not really a question, but wanted to document and share with the community...]

So, I had a customer that liked how JSON events showed up in the Events tab on the Search screen (e.g. colored format, collapse/expand). He wanted events that weren't JSON to show up this way, too! (I tried to explain that wasn't the purpose of this screen, but it was an interesting exercise, so what the heck....)

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

your search here
| foreach * 
    [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
| eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
| fields - jsonmv_

The resulting event(s) will be in JSON format, and will display with colors, etc. in Splunkweb.

NOTE: This is a VERY inefficient thing to do! You are basically having Splunk parse the event into fields (field extractions), then munging all those field back together into a JSON-formatted string, THEN having Splunk parse the JSON back into fields.

Like I said - an interesting exercise to see if it was possible, but not very useful in a production situation.

[kcepull2 · Accepted solution]

Here's what I came up with that will take any event, and format it as JSON so the Splunkweb JSON parser will kick in.

 your search here
 | foreach * 
     [eval jsonmv_ = mvappend(jsonmv_,"\"<<MATCHSTR>>\":\"" + <<FIELD>> + "\"")] 
 | eval _raw = "{" + mvjoin(jsonmv_,",") + "}" 
 | fields - jsonmv_

[damode1]

getting below error when I tried your spl

Failed to parse templatized search for field 'tag::eventtype'

[aaraneta_splunk]

Hello @kcepull2 - Thank you for sharing this question and providing a solution. Do you think you can put the solution as an answer below so it can be Accepted? That way this question doesn't look like its unanswered forever? Thanks in advance!

[kcepull2]

Sure! Thanks for the suggestion. 🙂