Splunk Search

How to export events as JSON format?

sutom
Path Finder

Hi All,

I am trying to export events in JSON format, and I am able to do it, and getting events like the one below.

 

{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}

 

But the My expectation of having these events in an array with commas separated like the below format.

 

[
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}},
{"preview":false,"result":{"_raw":"{\"tomLogs\":[{\"component\":\"tom\"}]}}}
]

 

Please provide some references that can help to export events in the expected format.

Labels (2)
Tags (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@sutom - I would say the export is correct, add the [ (square brackets) and , (commas) in the exported file manually by regex replace in any advance text/code editor.

This would be the simplest option to what you want to achive. You can also write a small python script to do that we well.

 

I hope this helps!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

The question is really "how to export events as JSON array."  Is this correct?  The result you got are a sequence of perfectly correct JSON events.

If you want all those events exported to one big array, why not put all events in one big array?  Like

| stats values(_raw) as jumbo_raw

The export will then look like

{"preview":false,"result":{"_raw":[
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]},
{"tomLogs":[{"component":"tom"}]}
]}
}

 Will this array do? Otherwise you can write a simple script to convert a series of JSON objects into a JSON array.

0 Karma

FelixLeh
Contributor

Have you tried using "KV_MODE = json" in props.conf where the corresponding Sourcetype is defined?

 

[your_sourcetype]
KV_MODE = json
#your other settings for the sourcetype:
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...