Splunk Search

Problem formatting string to json

trem124
New Member

Hi,

I have the following String that is logged by the application and I am wondering if there is a way to pretty print it just like the rest of the logs.

Here is the raw data :

{"timestamp":"2020-11-10T15:27:02.187Z","level":"INFO","thread":"main","logger":"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer","message":"{\"code\": \"CODE\",\"text\":null,\"origin\":null,\"rule\": \"RULE\"}","context":"default"}

I guess it has something to do with the characters being escaped but I did not find anything that got it to work properly.

I would like to have something like : 

{
"timestamp": "2020-11-09T20:54:57.245Z",
"level": "INFO",
"thread": "main",
"logger": "ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer",
"message": {
    "code": "CODE",
    "text": null,
    "origin": null,
    "rule": "RULE"},
"context": "default"
}

 

Thanks

Labels (3)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="{\"timestamp\":\"2020-11-10T15:27:02.187Z\",\"level\":\"INFO\",\"thread\":\"main\",\"logger\":\"ca.nbc.payment.pmtinternationallibrary.config.MyApplicationContextInitializer\",\"message\":\"{\\\"code\\\": \\\"CODE\\\",\\\"text\\\":null,\\\"origin\\\":null,\\\"rule\\\": \\\"RULE\\\"}\",\"context\":\"default\"}"
| rex mode=sed "s/\{/{\n/g s/,/,\n/g s/\n(?=\\\)/\n  /g s/\\\//g s/\}(?!\")/\n}/g s/\"\{/{/g s/\}\"/}/g"
| table _raw
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...