convert data in string format to json

[AnilPujar]

is there any function available in splunk which converts the data in string format to json, which is actually json data but missing quotations.

json payload.PNG

{uiType:Picker,model:{type:field,name:options_for_teams},plainTextMessage:Please select an option from the below list.,uiMetadata:{label:Please select an option from the below list.,itemType:ID,style:list,options:[{label:Create Service Request,value:Create Service Request,renderStyle:data,enabled:false},{label:Report an Incident,value:Report an Incident,renderStyle:data,enabled:false},{label:Check Incident/Request Status,value:Check Incident/Request Status,renderStyle:data,enabled:false},{label:Self-Service Knowledge Article,value:Self-Service Knowledge Article,renderStyle:data,enabled:false},{label:Submit your pending surveys,value:Submit your pending surveys,renderStyle:data,enabled:false},{label:Chat with Live Agent,value:Chat with Live Agent,renderStyle:data,enabled:false},{label:My Pending Approvals,value:My Pending Approvals,renderStyle:data,enabled:false},{label:Password Reset,value:Password Reset,renderStyle:data,enabled:false},{label:View My Assets,value:View My Assets,renderStyle:data,enabled:false},{label:Create An Emergency Change,value:Create An Emergency Change,renderStyle:data,enabled:false}],multiSelect:false,openByDefault:true,required:true,maskType:NONE,totalOptionsCount:10,totalSearchResultsCount:0,paginationBreak:-1},nluTextEnabled:false,value:View My Assets}

added the payload string for reference.

since this payload is in string format, i'm unable to use spath command.

[ITWhisperer]

Try something like this - it appears to work with the example given

| rex mode=sed "s/(?<delimiter>[\{,\[]+)?(?<key>\w+):(?<value>([\{\[]+|[^,\}]+))(?<close>[\}\],]+)?/\1\"\2\":\"\4\"\5/g s/\"(?<opening>[{\[]+)\"/\1/g"

[AnilPujar]

@ITWhisperer Thanks this helped at a certain level, it's adding quotations in some payload data where it contains URLs.

Thank you very much 🙂

[ITWhisperer]

Having said that, you may want to extend it to unquote the numerics