After receiving "External search command 'jsonfields' returned error code 1", how to extract fields from a JSON input?

[rodneyjerome]

Hi,
I am trying to extract fields from a JSON input. I don't understand if I am making any mistake in getting the events or in output. Below is my python script:

import splunk.Intersplunk

json_events = splunk.Intersplunk.readResults(None, None, True)

for json_event in json_events:
    json_data = json.load(json_event)
    fields = (json_data['Fields'])
    for f in fields:
        if not f['values']:
            json_event[f['Name']] = 'null'
        elif 'value' not in f['values'][0]:
            json_event[f['Name']] = 'null'
        else:
            json_event[f['Name']] = f['values'][0]['value']

splunk.Intersplunk.outputResults(json_events)

and the below snippet is a sample json event.

{
  "Type": "defect",
  "Fields": [
    {
      "values": [],
      "Name": "ut2"
    },
    {
      "values": [
        {
          "value": "SF"
        }
      ],
      "Name": "ut3"
    },
    {
      "values": [
        {
          "value": "2"
        }
      ],
      "Name": "vs"
    },
    {
      "values": [
        {
          "value": "N"
        }
      ],
      "Name": "attached"
    },
    {
      "values": [
        {
          "value": "vh"
        }
      ],
      "Name": "pri"
    },
],
}

I have stored them as dictionary (key, value pairs). I am getting error "External search command 'jsonfields' returned error code 1"
any suggestions?

Thanks in advance

[Flynt · Accepted solution]

Try the answer given here - https://answers.splunk.com/answers/474552/custom-command-for-json-event.html#answer-475585

[rodneyjerome]

sure i will try that and get back to you

[rodneyjerome]

Answer is in this link.

https://answers.splunk.com/answers/474552/custom-command-for-json-event.html