Getting Data In

convert raw data in the event into json format

sekhar463
Path Finder

Hai All,

we have some data coming from splunk DB connect and one field has RAW data as below 

how to convert the  json payload data into readable format as i have attached pic how it should convert and below is the json data 

The field we want to perform json operations on is report_json

tried with below search but not working and is anything we need to update in the DB query end to get the output

index="test1" 
| search NOT errors="*warning Puppet*" NOT errors="*Permission*" report_json=*
| eval json_string=json(report_json), test=report_json
| table json_string, test, len(test)


Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming your actually data has correct json (not the truncated version you supplied), if the report_json field has not already been extracted, then you can use this to extract it and use spath to parse the json string.

| rex "report_json=\"(?<report_json>.*)"
| spath input=report_json
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please explain what you mean by "not working".  What results do you expect and what results do you get?

The sample event does not contain valid JSON in the result_json field.  Specifically, it's missing a closing brace and bracket.  Splunk's JSON functions don't handle invalid JSON.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sekhar463
Path Finder

we are getting this data using DB connect from postgre db using below query and has 2 fields  report_json AND I have modified the query to to convert json object.

 

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...