Splunk Search

convert data in string format to json

AnilPujar
Path Finder

is there any function available in splunk which converts the data in string format to json, which is actually json data but missing quotations.

 

json payload.PNG

{uiType:Picker,model:{type:field,name:options_for_teams},plainTextMessage:Please select an option from the below list.,uiMetadata:{label:Please select an option from the below list.,itemType:ID,style:list,options:[{label:Create Service Request,value:Create Service Request,renderStyle:data,enabled:false},{label:Report an Incident,value:Report an Incident,renderStyle:data,enabled:false},{label:Check Incident/Request Status,value:Check Incident/Request Status,renderStyle:data,enabled:false},{label:Self-Service Knowledge Article,value:Self-Service Knowledge Article,renderStyle:data,enabled:false},{label:Submit your pending surveys,value:Submit your pending surveys,renderStyle:data,enabled:false},{label:Chat with Live Agent,value:Chat with Live Agent,renderStyle:data,enabled:false},{label:My Pending Approvals,value:My Pending Approvals,renderStyle:data,enabled:false},{label:Password Reset,value:Password Reset,renderStyle:data,enabled:false},{label:View My Assets,value:View My Assets,renderStyle:data,enabled:false},{label:Create An Emergency Change,value:Create An Emergency Change,renderStyle:data,enabled:false}],multiSelect:false,openByDefault:true,required:true,maskType:NONE,totalOptionsCount:10,totalSearchResultsCount:0,paginationBreak:-1},nluTextEnabled:false,value:View My Assets}

 

added the payload string for reference.

since this payload is in string format, i'm unable to use spath command.

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this - it appears to work with the example given

| rex mode=sed "s/(?<delimiter>[\{,\[]+)?(?<key>\w+):(?<value>([\{\[]+|[^,\}]+))(?<close>[\}\],]+)?/\1\"\2\":\"\4\"\5/g s/\"(?<opening>[{\[]+)\"/\1/g"
0 Karma

AnilPujar
Path Finder

@ITWhisperer Thanks this helped at a certain level, it's adding quotations in some payload data where it contains URLs.

 

Thank you very much 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Having said that, you may want to extend it to unquote the numerics

0 Karma
Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out &gt;&gt; Kudos to all the ...