Splunk Search

How to extract key value pairs from my sample data and have the output in JSON format?

bharat1478
New Member

I have a log that looks like this (with lot more fields):

04FEB2016_18:05:49.440 10789:1 INFO Struct='SListmanTskSubTranV6' IO='O' EventId=17086 Event='LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT' Order=1094966 To='MULT' ...

I want to extract events like these from Splunk and want the output to be a VALID json object. So in this case, output should look like:

{"Struct":'SListmanTskSubTranV6', "IO":'O', "EventId":17086, "Event":'LISTMAN_UPDATE_FOR_EXEC_RPT  REPORT', "Order":1094966, "To":'MULT'}

Is there a way to achieve this in Splunk? Our string field values can have spaces or characters like ', ", \, etc. in it

0 Karma

somesoni2
Revered Legend

See below link for different option to export search results (including json format)

http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Exportsearchresults#Choose_your_export_form...

0 Karma

bharat1478
New Member

We have a python service that is using REST API to query splunk. We want to get raw data from splunk in json format even though our actual log is in key=value format.
Looks like above documentation doesn't achieve that.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Why? Do you want to use Splunk as a log format converter!?
You can probably do that with a bunch of eval statements, but it won't be pretty.

0 Karma

bharat1478
New Member

We have an application that need this information in json format. We don't have the luxury to change the logging application to log in json format.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...