Getting Data In

How to get json portion of log entry to display as formatted JSON?

Path Finder

Hey gang - hopefully this isn't to bad of a question and I'm missing something simple.

I have an application that is writing data that looks like this:
    018-07-13 05:48:30.343 PDT [pool-3-thread-3]  INFO STATUS - {"well_formed_json": "yes"}

The Json document is far more elaborate, of course ... just here so you can get an idea. So I've got a query that can display this json alone:

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| table json 

And this is great ... I get a table with all of my JSON blocks. That's good as far as that goes. But how do I get Splunk to actually format that as json with the nice color-coding and nested levels folding and whatnot?

0 Karma
1 Solution

Revered Legend

Give this a try

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

View solution in original post

Revered Legend

Give this a try

index="myindex" | rex field=_raw "INFO STATUS - (?<json>.*)"| rename json as _raw

View solution in original post

Path Finder

wow - it worked!!

0 Karma

Revered Legend

Splunk does the auto-json formatting for the field _raw on Events tab, update _raw to just have the pure json content worked here. If there are no follow-up questions to this, please close this question by accepting this answer.

0 Karma

Path Finder

My only followup answer would be this: is there any way to get a partial row to display as JSON (with syntax help, etc) or must we get where it is the whole row (by doing the _raw rename)?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!