The JSON to CSV Converter process will convert JSON data to CSV format. One very useful feature of this process is that it reduces the volume of the data that is output to a target. Users of Splunk may want to output a CSV to a file target, then use the Universal Forwarder to send that data on to Splunk.
Note these limitations of the JSON to CSV converter:
- The keys within each successive JSON record must be identical. If the JSON to CSV converter detects that the keys in a record are different from the previous record, then it will log an error and it stop processing.
- The JSON to CSV converter is unable to handle JSON arrays.
- The JSON to CSV converter is unable to handle nested JSON objects inside the main root object.
- The order of the CSV fields will always be alphabetical, regardless of the order of the fields in the original JSON records.
Note that when an element monitor reports the number of Records handled and the Total records handled the CSV header is included in the count.
Example JSON to CSV Process File