Splunk Search

How to index perl hash data?

cblanton
Communicator

I have a the output of a Perl script as a Perl hash. I'm not able to run the script directly from Splunk, but would like to index the hashes by monitoring the location where they are saved. I tested one of the files, by trying to index it manually, but couldn't make sense of the data via the UX.

Can Splunk index a Perl hash?

As may be obvious, I don't have much experience with Perl, I just need to get the data indexed...

Tags (1)
0 Karma
1 Solution

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

View solution in original post

0 Karma

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

0 Karma

cblanton
Communicator

Thanks very much, Pavel. I'd just found the same solution with a colleague. Thanks for the confirmation that it will work!

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...