Hi All,
I am trying to export events in JSON format, and I am able to do it, and getting events like the one below.
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
But the My expectation of having these events in an array with commas separated like the below format.
[
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
]
Please provide some references that can help to export events in the expected format.
@sutom - I would say the export is correct, add the [ (square brackets) and , (commas) in the exported file manually by regex replace in any advance text/code editor.
This would be the simplest option to what you want to achive. You can also write a small python script to do that we well.
I hope this helps!!!
The question is really "how to export events as JSON array." Is this correct? The result you got are a sequence of perfectly correct JSON events.
If you want all those events exported to one big array, why not put all events in one big array? Like
| stats values(_raw) as jumbo_raw
The export will then look like
{"preview":false,"result":{"_raw":[
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]}
]}
}
Will this array do? Otherwise you can write a simple script to convert a series of JSON objects into a JSON array.
Have you tried using "KV_MODE = json" in props.conf where the corresponding Sourcetype is defined?
[your_sourcetype]
KV_MODE = json
#your other settings for the sourcetype: