Splunk Search

From InputStream to JsonArray

kalyani1184
New Member

I would like to know how to get a Json array from an InputStream Object.

Actually I am trying to store some splunk raw parameters like host, sourcetype, and source in a string list and then passed into JobResultArgs. Then passed into InputStream as a Job object. Now i want that to be passed to a Json Array to get the result size and pass throught the array and get the host and source objects.

JobResultsArgs jobRes = new JobResultsArgs();

      List<String> fields = new ArrayList<String>();

    fields.add("_raw");
    fields.add("host");
    fields.add("sourcetype");
    fields.add("source");

    jobRes.setFieldList((String[])fields.toArray());
    jobRes.setCount(2500);


    InputStream inpStream = job.getResults(jobRes);  
    ResultsReaderJson Jsa = new ResultsReaderJson(inpStream);

      //      System.out.println("result size: " + Jsa.size());
     //  for(int i = 0; i < Jsa.size(); i++) {


   //   JsonElement hostElement = Jsa.get(i).getAsJsonObject().get("host");
  //    JsonElement source = Jsa.get(i).getAsJsonObject().get("source");

The commented lines are not compatable with the code but i want to implement this kind of code. Is there a way i can get a Json Array from the InputStream

0 Karma

aryank4564
New Member
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

For the commented part you may be looking for ResultsReader.getNextEvent(): http://docs.splunk.com/DocumentationStatic/JavaSDK/1.0/index.html?com/splunk/ResultsReader.html

0 Karma

kalyani1184
New Member

Thank you for the response. I looked previously but that was not i wanted. I wanted to get the size of it and the host name source name which i could not find from that.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...