JSON Expander Bookmarklet

Reading nested JSON in Splunk usually means clicking [+] over and over, event after event. JSON Expander opens every collapsed field in the next JSON event with one click, highlights it and scrolls it into view. Click again for the next event.

It runs as a browser bookmarklet, so there is no extension to install, no permissions to grant and nothing to change in Splunk.

• Expands every collapsed JSON field in an event with one click
• Highlights the expanded event and scrolls it into view
• Finds the next collapsed event from the top of the page down
• Shows a notice once every event is expanded
• No extension, install or permissions: it's a bookmark
• Works with Splunk Enterprise and Splunk Cloud
• Chrome, Firefox, Edge and Safari

Use Cases

• Read nested JSON events during incident response without clicking through every field
• Review cloud, API and security logs that arrive as deeply nested JSON
• Step through search results one event at a time, each highlighted as it opens

Get Started

1. Drag the 《 JSON 》for SPL link at the top of this page to your bookmarks bar, or copy the code from GitHub into a new bookmark.
2. Run a Splunk search that returns JSON events.
3. Click the bookmark to expand the next collapsed event. Click again for the one after it.

Safari: turn on “Allow JavaScript from Smart Search field” under Settings, Developer.