Splunk Search

How to extract key value pairs from my sample data and have the output in JSON format?

bharat1478
New Member

I have a log that looks like this (with lot more fields):

04FEB2016_18:05:49.440 10789:1 INFO Struct='SListmanTskSubTranV6' IO='O' EventId=17086 Event='LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT' Order=1094966 To='MULT' ...

I want to extract events like these from Splunk and want the output to be a VALID json object. So in this case, output should look like:

{"Struct":'SListmanTskSubTranV6', "IO":'O', "EventId":17086, "Event":'LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT', "Order":1094966, "To":'MULT'}

Is there a way to achieve this in Splunk? Our string field values can have spaces or characters like ', ", \, etc. in it

0 Karma

somesoni2
Revered Legend

See below link for different option to export search results (including json format)

http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Exportsearchresults#Choose_your_export_form...

0 Karma

bharat1478
New Member

We have a python service that is using REST API to query splunk. We want to get raw data from splunk in json format even though our actual log is in key=value format.
Looks like above documentation doesn't achieve that.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Why? Do you want to use Splunk as a log format converter!?
You can probably do that with a bunch of eval statements, but it won't be pretty.

0 Karma

bharat1478
New Member

We have an application that need this information in json format. We don't have the luxury to change the logging application to log in json format.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...