Partial JSON formatting in an event

[trever]

I have events that often have lager JSON data in them, however, I need to send additional data along with them. Typically my events will look something like this:

timestamp="2021-03-02 11:46:48,745" correlationKey="30C05D96A7544BF3948034BE0C" level=INFO message="{'json': 'test'}"

What I would like to do is cover it so that the JSON gets formatted but allows me to keep the rest of the data in the event so that I can use the items like correlationKey. Is there some way I could do this? Perhaps with a custom source type? Right now if the JSON is too large it bogs down my search UI really badly when it has hundreds of lines of JSON. I want to be able to log the raw JSON response, though.

[mattymo]

Hello!

What are you currently using for your sourcetype settings?

Splunk's UI will pretty print well formatted json for you. Perhaps ensure you are using search time extractions and may uses path to target your field extractions? You could likely create custom key value extractions as well. 

I would recommend ensuring your source type (props.conf) has TRUNCATE set to a high number to make sure the json renders properly when those big events come in

[trever]

Hello! Splunk does this for me if the contents are only JSON but if I have the additional info in the event it doesn't. 

Example:

Versus

What I would like is a combo of these two.

timestamp="2021-03-02 12:24:43,128" correlationKey="87700F373CD84E85AF62A931F6" level=INFO message="
PRETTY_JSON
"

Does that make sense?