Splunk Search

Custom event viewer for records that have XML, JSON in addition to other data

Path Finder

I've got a large number of logs which look similar to:

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-] [pool-10-thread-1] {"metaData":{"sourceURI":"/search/" ....}}


INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-] [pool-10-thread-1] payload=<event type="x12">...</event>

in addition to log entries with a freeform text or name-value pair load.

It the whole event was JSON then Splunk would format this nicely in the event viewer panel but this doesn't work for the above mixed entries. Changing the logs to all JSON is at present not an option.

One way seems to be creating custom events viewers that would deal with displaying above mixed events so users awkwardly end up copy-pasting payload into a JSON or XML formatter.
I hope it's possible to improve presentation of events with mixed content with limited effort, e.g. by facilitating an already existing Splunk app or deriving custom events viewers from existing ones.

What are my options?

0 Karma

Splunk Employee
Splunk Employee
0 Karma


"Beginning with version 6.0, Splunk Enterprise does not support the customization of event displays using event renderers"

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...