Maybe you can clarify "translate the splunk index data."  Do you mean to dump raw Splunk data into JSON?  How is that useful? In any case, you can always use tojson command after any search you do.  For example, splunk search "index=_* earliest=-4h |stats count by index |tojson" >count.json   ... View more

Hi @zsbbb, You can export any search output as json using below sample; curl -k -u admin:changeme https://localhost:8089/services/search/jobs/export -d search="search sourcetype=access_* earliest=-7d" -d output_mode=json -o /path/to/local/file.json ... View more