Reporting

Exporting in JSON

chipmunk
Engager

outputcsv exports data in csv format. Can I output it to .json format ?

Tags (1)

doksu
Contributor

I just wrote an app that can create JSON in-line: https://splunkbase.splunk.com/app/3540/

With this you could convert _raw (and any other fields not from _raw) to JSON, then export a "csv" with one field containing the JSON.

... | mkjson outputfield=json | table json | outputcsv mycsv

Be sure to read the Usage guide (https://github.com/doksu/TA-jsontools/wiki#usage-1) which has a range of examples.

0 Karma

manish_singh_77
Builder

@doksu

I have a query where we are trying to output the results into csv but now we would like to have that in json format.

Can we do that through this app?

0 Karma

doksu
Contributor

I'm not sure I understand the question. Splunk cannot write to a json file, however you can produce JSON using the mkjson command as seen above then pipe that to another command like outputcsv to dump that to disk (JSON inside a CSV).

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

There is no analogous search command to write a JSON formatted file from within a search itself. You can run a search using the REST API (http://www.splunk.com/base/Documentation/latest/Developer/RESTIntro) and fetch the results in JSON format using the argument output_mode=json from the events, results or results_preview resources.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...