Skip to content
866.528.5011 Book a Call
← All Apps

JSON Expander Bookmarklet

Splunk search in any modern browser

Expands every collapsed JSON field in a Splunk search event with one click.

Get It on GitHub ↗Get Help Setting It Up
Drag it to your bookmarks bar《 JSON 》for SPL

  • One Click per Event

    Expands every collapsed JSON field, then highlights the event and scrolls it into view.

  • Nothing to Install

    A browser bookmark. No extension, permissions or changes to Splunk.

  • Every Major Browser

    Chrome, Firefox, Edge and Safari, on Splunk Enterprise and Splunk Cloud.

Overview

Reading nested JSON in Splunk means clicking [+] over and over. JSON Expander opens every collapsed field in the next event with one click. Click again for the next one.

Features

  • Expands every collapsed JSON field in an event with one click
  • Highlights the event and scrolls it into view
  • Moves to the next collapsed event on each click, with a notice once all are expanded
  • No extension, install or permissions

Use Cases

  • Read nested JSON during incident response without clicking through every field
  • Review cloud, API and security logs that arrive as deeply nested JSON

Get Started

  1. Drag the 《 JSON 》for SPL link at the top of this page to your bookmarks bar, or copy the code from GitHub into a new bookmark.
  2. Run a Splunk search that returns JSON events.
  3. Click the bookmark to expand the next collapsed event.

Safari: turn on “Allow JavaScript from Smart Search field” under Settings, Developer.

← Back to Splunk Apps

Need a Tool That Doesn’t Exist Yet?

We build Splunk apps, Outlook add-ins and internal tools like this one for clients.

Have One Built →