ansible - parsing json w jmesquery

Question

I'm querying Splunk via the uri module w a certain search:

- name: splunk query
  uri:
    url: https://localhost:8089/servicesNS/admin/search/search/jobs/export?output_mode=json
    method: POST
    user: ...
    password: ...
    validate_certs: false
    body_format: form-urlencoded
    return_content: true
    headers:
      Content-Type: application/json
    body:
      - [ search, "{{ splunk_search }}" ]
  vars:
    - splunk_search: '| ...'
  register: me

Splunk returns a 200, w content:

TASK [debug] ********************************************************************************************************************************************************************************************
ok: [host1] => {
    "msg": "{\n  \"title\": \"clientMessageId\",\n  \"app\": \"whatever\"\n}\n{\n  \"title\": \"a_title\",\n  \"app\": \"some_app\"\n}\n{\n  \"title\": \"another_title\",\n  \"app\": \"my_app\"\n}\n{\n  \"title\": \"title_for_app\",\n  \"app\": \"another_app\"\n}"
}

However, I can't properly parse the output, I've tried:

- name: query result from content
  debug:
    msg: "{{ me.content | json_query('title') }}"

In this case, Ansible will return an empty string. I assume something is wrong with the formatting of the output.

Q: How can I configure Ansible to properly parse the json output, so that a new list is created based on the output.

Example:

my_list:
  - title: clientMessageId
    app: whatever
  - title: a_title
    app: some_app
...

Try `{{ me.content|from_yaml }}` You should get the dictionary. — Vladimir Botka, Nov 15 '22 at 12:32
Then I receive a weird error: `ParserError: expected '', but found '{' in "", line 2, column 1: {"preview":false,"offset":1,"res ... ^` — Kevin C, Nov 15 '22 at 12:42
JMESPath or `json_query`. The mix up sounds funny though _"jmesquery"_. — β.εηοιτ.βε, Nov 15 '22 at 15:22
My guess is: you are hitting the `json_query` on variable issue that can be fixed with a `| to_json | from_json` workaround, see https://stackoverflow.com/a/66469617/2123530 — β.εηοιτ.βε, Nov 16 '22 at 10:58

score 0 · Answer 1 · answered Nov 15 '22 at 21:12

What I did was change the url output_mode in which Splunk returns the content from json to csv.

url: https://localhost:8089/servicesNS/admin/search/search/jobs/export?output_mode=csv

Then, I wrote the output to a file and read it using the ansible read_csv module.

- name: write received content to csv file on controller
  copy:
    content: "{{ me.content }}"
    dest: "./file.csv"
    mode: '0775'
  delegate_to: localhost

- name: read csv file
  read_csv:
    path: ./file.csv
  delegate_to: localhost
  register: read_csv

- name: set fact to create list
  set_fact:
    the_output: "{{ read_csv.list }}"

ansible - parsing json w jmesquery

1 Answers1