Splunk Search

Custom event viewer for records that have XML, JSON in addition to other data

Path Finder

I've got a large number of logs which look similar to:

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-] [pool-10-thread-1] {"metaData":{"sourceURI":"/search/" ....}}


INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-] [pool-10-thread-1] payload=<event type="x12">...</event>

in addition to log entries with a freeform text or name-value pair load.

It the whole event was JSON then Splunk would format this nicely in the event viewer panel but this doesn't work for the above mixed entries. Changing the logs to all JSON is at present not an option.

One way seems to be creating custom events viewers that would deal with displaying above mixed events so users awkwardly end up copy-pasting payload into a JSON or XML formatter.
I hope it's possible to improve presentation of events with mixed content with limited effort, e.g. by facilitating an already existing Splunk app or deriving custom events viewers from existing ones.

What are my options?

0 Karma

Splunk Employee
Splunk Employee
0 Karma


"Beginning with version 6.0, Splunk Enterprise does not support the customization of event displays using event renderers"

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!