Getting Data In

How can I change the output of a search job to JSON?

mwcooley
Explorer

I'm not a developer, so please bear with me. i'm using service.savedSearches.fetch, then mySavedSearch.dispatch(function(err, job) to dispatch my search. It's working, but the object returned is in JSON_ROWS.

The Splunk docs here seem to suggest I can change the output from JSON_ROWS to plain JSON, but I can't figure out how to change from the default value.

thanks,
mike

0 Karma

mwcooley
Explorer

Hi,

I figured it out, with the help of a co-worker.

I added output_mode to the job:

job.results({
count: 10,
output_mode: "JSON"
}, function(err, myObj, job) {
...
});

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...