Reporting

Exporting in JSON

chipmunk
Engager

outputcsv exports data in csv format. Can I output it to .json format ?

Tags (1)

doksu
Contributor

I just wrote an app that can create JSON in-line: https://splunkbase.splunk.com/app/3540/

With this you could convert _raw (and any other fields not from _raw) to JSON, then export a "csv" with one field containing the JSON.

... | mkjson outputfield=json | table json | outputcsv mycsv

Be sure to read the Usage guide (https://github.com/doksu/TA-jsontools/wiki#usage-1) which has a range of examples.

0 Karma

manish_singh_77
Builder

@doksu

I have a query where we are trying to output the results into csv but now we would like to have that in json format.

Can we do that through this app?

0 Karma

doksu
Contributor

I'm not sure I understand the question. Splunk cannot write to a json file, however you can produce JSON using the mkjson command as seen above then pipe that to another command like outputcsv to dump that to disk (JSON inside a CSV).

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

There is no analogous search command to write a JSON formatted file from within a search itself. You can run a search using the REST API (http://www.splunk.com/base/Documentation/latest/Developer/RESTIntro) and fetch the results in JSON format using the argument output_mode=json from the events, results or results_preview resources.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...