Custom event viewer for records that have XML, JSON in addition to other data

[tpflicke]

I've got a large number of logs which look similar to:

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] {"metaData":{"sourceURI":"/search/" ....}}

and

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] payload=<event type="x12">...</event>

in addition to log entries with a freeform text or name-value pair load.

It the whole event was JSON then Splunk would format this nicely in the event viewer panel but this doesn't work for the above mixed entries. Changing the logs to all JSON is at present not an option.

One way seems to be creating custom events viewers that would deal with displaying above mixed events so users awkwardly end up copy-pasting payload into a JSON or XML formatter.
I hope it's possible to improve presentation of events with mixed content with limited effort, e.g. by facilitating an already existing Splunk app or deriving custom events viewers from existing ones.

What are my options?

[gkanapathy]

Have you looked at a custom event renderers?

http://docs.splunk.com/Documentation/Splunk/6.0.1/AdvancedDev/EventRendering

[Rocket66]

"Beginning with version 6.0, Splunk Enterprise does not support the customization of event displays using event renderers"
:(