Splunk Search

Partial JSON formatting in an event

trever
Loves-to-Learn

I have events that often have lager JSON data in them, however, I need to send additional data along with them. Typically my events will look something like this:

 

timestamp="2021-03-02 11:46:48,745" correlationKey="30C05D96A7544BF3948034BE0C" level=INFO message="{'json': 'test'}"

 

What I would like to do is cover it so that the JSON gets formatted but allows me to keep the rest of the data in the event so that I can use the items like correlationKey. Is there some way I could do this? Perhaps with a custom source type? Right now if the JSON is too large it bogs down my search UI really badly when it has hundreds of lines of JSON. I want to be able to log the raw JSON response, though.

Labels (2)
Tags (3)
0 Karma

mattymo
Splunk Employee
Splunk Employee

Hello!

What are you currently using for your sourcetype settings?

Splunk's UI will pretty print well formatted json for you. Perhaps ensure you are using search time extractions and may uses path to target your field extractions? You could likely create custom key value extractions as well. 

I would recommend ensuring your source type (props.conf) has TRUNCATE set to a high number to make sure the json renders properly when those big events come in

0 Karma

trever
Loves-to-Learn

Hello! Splunk does this for me if the contents are only JSON but if I have the additional info in the event it doesn't. 

Example:

trever_1-1614716722765.png

Versus

trever_2-1614716749972.png

 

What I would like is a combo of these two.

timestamp="2021-03-02 12:24:43,128" correlationKey="87700F373CD84E85AF62A931F6" level=INFO message="
PRETTY_JSON
"

 

Does that make sense?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!