Getting Data In
Highlighted

my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

Builder

I have python script configured in the HF , the script output are enclosed with unicode character U' in the output so splunk is unable to parse the fields properly.

script output:

{u'rows': [{u'timestamp': 1585924500001L, u'RAM_': 1000, u'Allocated': 4000.78, u'queue': 0, u'Details':  u'Connected': 2, u'Queue': 0, u'EventsQueue': 0}]

I had include in Props.conf for charset but still it was not parsing properly.

props.conf
[sourcetype::GetStreamData]
CHARSET=utf-8

[sourcetype::GetStreamData]
CHARSET=utf-8

0 Karma
Highlighted

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

SplunkTrust
SplunkTrust

@premranjithj

Are you using json.dumps in python file?? Can you please share your sample code ?

Updating Answer

Can you please replace return json_obj with return json.dump(json_obj) and try ?

View solution in original post

Highlighted

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

Builder

@kamlesh_vaghela
this is the code which i am using.

import requests
import json

headers={
        "accept": "application/json",
        "content-type": "application/json"
    }

test_urls = ['https://google.com']


def return_json(url):
    try:
        response = requests.get(url,headers=headers)

        # Consider any status other than 2xx an error
        if not response.status_code // 100 == 2:
            return "Error: Unexpected response {}".format(response)

        json_obj = response.json()
        return json_obj
    except requests.exceptions.RequestException as e:
        # A serious problem happened, like an SSLError or InvalidURL
        return "Error: {}".format(e)


for url in test_urls:

    print "Fetching URL '{}'".format(url)
    print return_json(url)
0 Karma
Highlighted

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

SplunkTrust
SplunkTrust

@premranjithj

Can you please replace return json_obj with return json.dump(json_obj) and try ?

Highlighted

Re: my python output with Json format is enclosed with Unicode character and so splunk is not parsing properly the fields

Builder

@kamlesh_vaghela thanks , it worked with dumps.
Please convert it into answer to accept it

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.