Getting Data In

my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

DataOrg
Builder

I have python script configured in the HF , the script output are enclosed with unicode character U' in the output so splunk is unable to parse the fields properly.

script output:

{u'rows': [{u'timestamp': 1585924500001L, u'RAM_': 1000, u'Allocated': 4000.78, u'queue': 0, u'Details':  u'Connected': 2, u'Queue': 0, u'EventsQueue': 0}]

I had include in Props.conf for charset but still it was not parsing properly.

props.conf
[sourcetype::GetStreamData]
CHARSET=utf-8

[sourcetype::GetStreamData]
CHARSET=utf-8

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

DataOrg
Builder

@kamlesh_vaghela
this is the code which i am using.

import requests
import json

headers={
        "accept": "application/json",
        "content-type": "application/json"
    }

test_urls = ['https://google.com']


def return_json(url):
    try:
        response = requests.get(url,headers=headers)

        # Consider any status other than 2xx an error
        if not response.status_code // 100 == 2:
            return "Error: Unexpected response {}".format(response)

        json_obj = response.json()
        return json_obj
    except requests.exceptions.RequestException as e:
        # A serious problem happened, like an SSLError or InvalidURL
        return "Error: {}".format(e)


for url in test_urls:

    print "Fetching URL '{}'".format(url)
    print return_json(url)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@premranjithj

Can you please replace return json_obj with return json.dump(json_obj) and try ?

DataOrg
Builder

@kamlesh_vaghela thanks , it worked with dumps.
Please convert it into answer to accept it

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...