Making a JSON string for SimData's Event Template

[colbym1]

I am trying to make events with SimData that use the json format. The problem comes when I need to make the "template" for the event in SimData because of all of the double quotes needed for json.

When I try to escape them, SimData never gets rid of them:

Code:

event WebRequest {
      required: [flow_id, event_type, src_ip, src_port, dest_ip, dest_port, proto];
      //template: "{{_time}} hello world";
      template: "{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}";
      source: "simdata";
      sourcetype: "suricata";
}

What shows in Splunk:
{\"timestamp\": {{_time}}, \"flow_id\": {{flow_id}}, \"event_type\": \"{{event_type}}\", \"src_ip\": \"{{src_ip}}\", \"src_port\": \"{{src_port}}\", \"dest_ip\": \"{{dest_ip}}\", \"dest_port\": \"{{dest_port}}\", \"proto\": \"{{proto}}\"}

I'm sure that you can see that having \ everywhere is a problem. I honestly think this may be an error on the side of SimData not sanitizing data before sending it off to the HEC because when you print the same event to the console with the 'Text' transport then there are no \" because when printing Java makes sure to take care of that.

Does anyone have a current workaround for this, or am I just crazy and can't figure out how to do this correctly?

Thanks for your time.

[colbym1 · Accepted solution]

So, I have been working with the Splunk team on this. The docs should reflect this now, but what I learned is that if you are using json format then just don't use a template. SimData will automatically put the data in json format just based on the required values you provide...

event TicketPlaced {
      required: [item, place, time];
      source: "https://foo.com/";
      sourcetype: "foo";
}

will give you:

{
   "item": item,
   "place": place,
   "time": time
}