Splunk Search

Problem formatting string to json

trem124
New Member

Hi,

I have the following String that is logged by the application and I am wondering if there is a way to pretty print it just like the rest of the logs.

Here is the raw data :

{"timestamp":"2020-11-10T15:27:02.187Z","level":"INFO","thread":"main","logger":"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer","message":"{\"code\": \"CODE\",\"text\":null,\"origin\":null,\"rule\": \"RULE\"}","context":"default"}

I guess it has something to do with the characters being escaped but I did not find anything that got it to work properly.

I would like to have something like : 

{
"timestamp": "2020-11-09T20:54:57.245Z",
"level": "INFO",
"thread": "main",
"logger": "ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer",
"message": {
    "code": "CODE",
    "text": null,
    "origin": null,
    "rule": "RULE"},
"context": "default"
}

 

Thanks

Labels (3)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="{\"timestamp\":\"2020-11-10T15:27:02.187Z\",\"level\":\"INFO\",\"thread\":\"main\",\"logger\":\"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer\",\"message\":\"{\\\"code\\\": \\\"CODE\\\",\\\"text\\\":null,\\\"origin\\\":null,\\\"rule\\\": \\\"RULE\\\"}\",\"context\":\"default\"}"
| rex mode=sed "s/\{/{\n/g s/,/,\n/g s/\n(?=\\\)/\n  /g s/\\\//g s/\}(?!\")/\n}/g s/\"\{/{/g s/\}\"/}/g"
| table _raw
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>