Splunk Search

Failed to parse a JSON string

erwanlebaron
Engager

Hi

 

I get data from an CSV file and one of the filed imported is a JSON string called "Tags" which looks like that

Tags = {"tag1": "toto" "tag2": "tata" "tag4": "titi"}  --> exemple for a line
Tags = {"tag3": "toto" "tag4": "tata"}  --> exemple for another line

 

The delimitation between key and value is <colon>+<space>
The delimitation between two key+value is <space>

 

I tried 

 

 

| spath input=Tags

 

 

but when I do

 

 

| table tag1, tag2, tag3, tag4

 

 

I get value only for tag1.

 

I tried to find a way to solve it by looking other topics but I do not succed.

I understood that my string is not correctly formatted like a "real" Json but I don't fin the command to convert my initialy field "Tags" into a correct Json format to apply the "spath" command

 

Is there anybody has an idea to do it

 

Thanks in adance

Labels (1)
Tags (3)
0 Karma

erwanlebaron
Engager

It works by doing that before the spath command

 

| eval Tags_json=replace(Tags,": ",":")
| eval Tags_json=replace(Tags_json,"\" \"","\",\"")

 

But it doesn't look very elegant...

 

There is a better solution ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

How to Monitor AI Agents with Splunk Agent Observability

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...