Splunk Search

Convert stats to JSON

wpb162
Explorer

I have a user who wants to send a table resulting from | stats values() to a summary index via the collect command, but all of the logs in this summary index need to be in json format. By default, collect just separates the field-value pairs by commas. How would we format these in json before or after the collect command sends them to the summary index?

Labels (2)
0 Karma

woodcock
Esteemed Legend

Like this:

index=_*
| stats count values(sourcetype) AS sourcetype BY index
| tojson
| eval _time = now()
| table _raw
| collect index=main source="test" addtime=true testmode=true

wpb162
Explorer

I appreciate your answer, and I hope to be able to use it very soon. However, we currently are running Splunk version 8.0.10, so I don't believe the tojson command is available to us.  If there is another (probably more complicated) way to do that with our current version, that would be fantastic. Otherwise, I expect we will have to wait until we upgrade.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

8.0 line has been unsupported for 1.5 years already...

Anyway, you can try to eval a json structure using json functions https://docs.splunk.com/Documentation/Splunk/8.0.10/SearchReference/JSONFunctions

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...