We have below data in json format, i need help with a custom json response handler so splunk can break every event separately. Each event starts with the record_id
{
"eventData": [
{
"record_id": "19643",
"eventID": "1179923",
"loginID": "PLI",
"userDN": "cn=564SD21FS8DF32A1D87FAD1F,cn=Users,dc=us,dc=oracle,dc=com",
"type": "CredentialValidation",
"ipAddress": "w.w.w.w",
"status": "success",
"accessTime": "2024-08-29T06:23:03.487Z",
"oooppd": "5648sd1csd-952f-d630a41c87ed-000a3e2d",
"attributekey": "User-Agent",
"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
},
{
"record_id": "19644",
"eventID": "1179924",
"loginID": "OKP",
"userDN": "cn=54S6DF45S212XCV6S8DF7,cn=Users,dc=us,dc=CVGH,dc=com",
"type": "Logout",
"ipAddress": "X.X.X.X",
"status": "success",
"accessTime": "2024-08-29T06:24:05.040Z",
"oooppd": "54678S3D2FS962SDFV3246S8DF",
"attributekey": "User-Agent",
"attributevalue": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
}
]
}
I found below response handler, will this work or does it require any modification? as per the sample in my original request.
class ArrayHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint,oauth2=None):
if response_type == "json":
raw_json = json.loads(raw_response_output)
column_list = []
for column in raw_json['columns']:
column_list.append(column['name'])
for row in raw_json['rows']:
i = 0;
new_event = {}
for row_item in row:
new_event[column_list[i]] = row_item
i = i+1
print(print_xml_stream(json.dumps(new_event)))
else:
print_xml_stream(raw_response_output)