Getting Data In

my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

DataOrg
Builder

I have python script configured in the HF , the script output are enclosed with unicode character U' in the output so splunk is unable to parse the fields properly.

script output:

{u'rows': [{u'timestamp': 1585924500001L, u'RAM_': 1000, u'Allocated': 4000.78, u'queue': 0, u'Details':  u'Connected': 2, u'Queue': 0, u'EventsQueue': 0}]

I had include in Props.conf for charset but still it was not parsing properly.

props.conf
[sourcetype::GetStreamData]
CHARSET=utf-8

[sourcetype::GetStreamData]
CHARSET=utf-8

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

DataOrg
Builder

@kamlesh_vaghela
this is the code which i am using.

import requests
import json

headers={
        "accept": "application/json",
        "content-type": "application/json"
    }

test_urls = ['https://google.com']


def return_json(url):
    try:
        response = requests.get(url,headers=headers)

        # Consider any status other than 2xx an error
        if not response.status_code // 100 == 2:
            return "Error: Unexpected response {}".format(response)

        json_obj = response.json()
        return json_obj
    except requests.exceptions.RequestException as e:
        # A serious problem happened, like an SSLError or InvalidURL
        return "Error: {}".format(e)


for url in test_urls:

    print "Fetching URL '{}'".format(url)
    print return_json(url)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Can you please replace return json_obj with return json.dump(json_obj) and try ?

DataOrg
Builder

@kamlesh_vaghela thanks , it worked with dumps.
Please convert it into answer to accept it

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...