Getting Data In

Making a JSON string for SimData's Event Template

colbym1
Engager

I am trying to make events with SimData that use the json format. The problem comes when I need to make the "template" for the event in SimData because of all of the double quotes needed for json.

When I try to escape them, SimData never gets rid of them:

Code:

event WebRequest {
      required: [flow_id, event_type, src_ip, src_port, dest_ip, dest_port, proto];
      //template: "{{_time}} hello world";
      template: "{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}";
      source: "simdata";
      sourcetype: "suricata";
}

What shows in Splunk:
{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}

I'm sure that you can see that having \ everywhere is a problem. I honestly think this may be an error on the side of SimData not sanitizing data before sending it off to the HEC because when you print the same event to the console with the 'Text' transport then there are no \" because when printing Java makes sure to take care of that.

Does anyone have a current workaround for this, or am I just crazy and can't figure out how to do this correctly?

Thanks for your time.

0 Karma
1 Solution

colbym1
Engager

So, I have been working with the Splunk team on this. The docs should reflect this now, but what I learned is that if you are using json format then just don't use a template. SimData will automatically put the data in json format just based on the required values you provide...

event TicketPlaced {
      required: [item, place, time];
      source: "https://foo.com/";
      sourcetype: "foo";
}

will give you:

{
   "item": item,
   "place": place,
   "time": time
}

View solution in original post

0 Karma

colbym1
Engager

So, I have been working with the Splunk team on this. The docs should reflect this now, but what I learned is that if you are using json format then just don't use a template. SimData will automatically put the data in json format just based on the required values you provide...

event TicketPlaced {
      required: [item, place, time];
      source: "https://foo.com/";
      sourcetype: "foo";
}

will give you:

{
   "item": item,
   "place": place,
   "time": time
}
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...