Splunk Search

How to extract key value pairs from my sample data and have the output in JSON format?

bharat1478
New Member

I have a log that looks like this (with lot more fields):

04FEB2016_18:05:49.440 10789:1 INFO Struct='SListmanTskSubTranV6' IO='O' EventId=17086 Event='LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT' Order=1094966 To='MULT' ...

I want to extract events like these from Splunk and want the output to be a VALID json object. So in this case, output should look like:

{"Struct":'SListmanTskSubTranV6', "IO":'O', "EventId":17086, "Event":'LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT', "Order":1094966, "To":'MULT'}

Is there a way to achieve this in Splunk? Our string field values can have spaces or characters like ', ", \, etc. in it

0 Karma

somesoni2
Revered Legend

See below link for different option to export search results (including json format)

http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Exportsearchresults#Choose_your_export_form...

0 Karma

bharat1478
New Member

We have a python service that is using REST API to query splunk. We want to get raw data from splunk in json format even though our actual log is in key=value format.
Looks like above documentation doesn't achieve that.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Why? Do you want to use Splunk as a log format converter!?
You can probably do that with a bunch of eval statements, but it won't be pretty.

0 Karma

bharat1478
New Member

We have an application that need this information in json format. We don't have the luxury to change the logging application to log in json format.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...