Getting Data In

How to get json portion of log entry to display as formatted JSON?

ShagVT
Path Finder

Hey gang - hopefully this isn't to bad of a question and I'm missing something simple.

I have an application that is writing data that looks like this:
    018-07-13 05:48:30.343 PDT [pool-3-thread-3]  INFO STATUS - {"well_formed_json": "yes"}

The Json document is far more elaborate, of course ... just here so you can get an idea. So I've got a query that can display this json alone:

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| table json 

And this is great ... I get a table with all of my JSON blocks. That's good as far as that goes. But how do I get Splunk to actually format that as json with the nice color-coding and nested levels folding and whatnot?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

ShagVT
Path Finder

wow - it worked!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Splunk does the auto-json formatting for the field _raw on Events tab, update _raw to just have the pure json content worked here. If there are no follow-up questions to this, please close this question by accepting this answer.

0 Karma

ShagVT
Path Finder

My only followup answer would be this: is there any way to get a partial row to display as JSON (with syntax help, etc) or must we get where it is the whole row (by doing the _raw rename)?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...