Splunk Search

Custom event viewer for records that have XML, JSON in addition to other data

tpflicke
Path Finder

I've got a large number of logs which look similar to:

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] {"metaData":{"sourceURI":"/search/" ....}}

and

INFO  com.this.that.SomeLogger 2014-05-08 08:29:49,997 [CSP-12.3.4.3245432] [pool-10-thread-1] payload=<event type="x12">...</event>

in addition to log entries with a freeform text or name-value pair load.

It the whole event was JSON then Splunk would format this nicely in the event viewer panel but this doesn't work for the above mixed entries. Changing the logs to all JSON is at present not an option.

One way seems to be creating custom events viewers that would deal with displaying above mixed events so users awkwardly end up copy-pasting payload into a JSON or XML formatter.
I hope it's possible to improve presentation of events with mixed content with limited effort, e.g. by facilitating an already existing Splunk app or deriving custom events viewers from existing ones.

What are my options?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

Rocket66
Communicator

"Beginning with version 6.0, Splunk Enterprise does not support the customization of event displays using event renderers"
:(

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...