is there any function available in splunk which converts the data in string format to json, which is actually json data but missing quotations.   {uiType:Picker,model:{type:field,name:options_for_teams},plainTextMessage:Please select an option from the below list.,uiMetadata:{label:Please select an option from the below list.,itemType:ID,style:list,options:[{label:Create Service Request,value:Create Service Request,renderStyle:data,enabled:false},{label:Report an Incident,value:Report an Incident,renderStyle:data,enabled:false},{label:Check Incident/Request Status,value:Check Incident/Request Status,renderStyle:data,enabled:false},{label:Self-Service Knowledge Article,value:Self-Service Knowledge Article,renderStyle:data,enabled:false},{label:Submit your pending surveys,value:Submit your pending surveys,renderStyle:data,enabled:false},{label:Chat with Live Agent,value:Chat with Live Agent,renderStyle:data,enabled:false},{label:My Pending Approvals,value:My Pending Approvals,renderStyle:data,enabled:false},{label:Password Reset,value:Password Reset,renderStyle:data,enabled:false},{label:View My Assets,value:View My Assets,renderStyle:data,enabled:false},{label:Create An Emergency Change,value:Create An Emergency Change,renderStyle:data,enabled:false}],multiSelect:false,openByDefault:true,required:true,maskType:NONE,totalOptionsCount:10,totalSearchResultsCount:0,paginationBreak:-1},nluTextEnabled:false,value:View My Assets}   added the payload string for reference. since this payload is in string format, i'm unable to use spath command.   ... View more

Search Head Cluster push bundle is too slow after splunk upgrade Bundle Push was so quick in my Splunk version 7.2.9, after upgrading to 8.2 it's taking more time to push the bundle to the cluster. ... View more

<form script="search:tabs.js,custom_vizs:autodiscover.js, custom_vizs:dendrogram.js" stylesheet="search:da_service.css,search:tabs.css,custom_vizs:dendrogram.css" hideSplunkBar="true"> --------------------------------------------------------------------------------------------------- common.js:1798 SyntaxError: Unexpected token , in JSON at position 49 at JSON.parse (<anonymous>) at _decodeOptions (dashboard_1.1.js:277) at dashboard_1.1.js:277 at Function._.each._.forEach (common.js:1798) at Function.ready._enableComponentDivs (dashboard_1.1.js:277) at dashboard_1.1.js:277 at Object.execCb (eval at module.exports (common.js:1117), <anonymous>:1658:33) at Module.check (eval at module.exports (common.js:1117), <anonymous>:869:55) at Module.eval (eval at module.exports (common.js:1117), <anonymous>:1121:34) at eval (eval at module.exports (common.js:1117), <anonymous>:132:23) --------------------------------------------------------------------------------------------------- Failed to load resource: net::ERR_CONNECTION_TIMED_OUT  https://e1345286.api.splkmobile.com/1.0/e1345286//0/1 --------------------------------------------------------------------------------------------------- Refused to apply style from 'https://*************:8000/en-US/static/@2e1fca123028.225/app/custom_vizs/dendrogram.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled. ... View more

Does Splunk have any spl command like punct? The default punct field will get patterns on the _raw field. Is there any command where I can use to get the similar pattern on the custom field instead of _raw? Example: description="User: ABC Project: XYZ Company Name: JKLM Short Description: Project is so and so" description="User: ABC Company Name: JKLM Project: XYZ Employee Level: 7 Short Description: Project is so and so User Designation: Splunk Consultant" description="User: ABC Project: Jkl Company Name: JKLM Short Description: Project: Automation" so on.. I cannot use extract command, because sub fields which i want to extract is not in order and key as 2/3/4/5 words. the only key value delim I can see is colon : and also some times user might feed : in certain sub fields.   ... View more