Splunk Search

How to index perl hash data?

cblanton
Communicator

I have a the output of a Perl script as a Perl hash. I'm not able to run the script directly from Splunk, but would like to index the hashes by monitoring the location where they are saved. I tested one of the files, by trying to index it manually, but couldn't make sense of the data via the UX.

Can Splunk index a Perl hash?

As may be obvious, I don't have much experience with Perl, I just need to get the data indexed...

Tags (1)
0 Karma
1 Solution

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

View solution in original post

0 Karma

PavelP
Motivator

You have to add just two/three lines to your perl script

use JSON;

ob top after #!/usr/bin/perl

and

my $json = encode_json \%hash;
print $json;

instead of the Line which prints the hash.

Splunk can read json quite well

0 Karma

cblanton
Communicator

Thanks very much, Pavel. I'd just found the same solution with a colleague. Thanks for the confirmation that it will work!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!