JSON Expander for Splunk by aserpi

A browser extension that instantly expands JSON objects in Splunk search results.

Splunk's default view collapses nested JSON data, requiring tedious manual clicks to inspect your logs.
This extension automates the process so you can focus on analysis.

Features

• Automatic expansion: When you allow a domain, JSON results expand automatically as soon as they are loaded.
• One-click expansion: Click the extension icon to instantly expand JSON results on any Splunk page without permanently allowing the domain.
• Customizable depth: Independently configure how many levels deep the JSON should be expanded for both automatic and manual triggers (leave empty for all levels).

Automatic expansion
If you use Splunk frequently on a specific domain, you can allow the extension to run automatically:

1. Navigate to your Splunk domain.
2. Open the extension's context menu.
3. Select Always allow on [domain].

To remove the site permission, you can either:

• Navigate to the website and do it from the extension's context menu.
• In the extension's options page, go to the Permissions and data tab and uncheck the domain.

Manual trigger
If you prefer not to grant persistent permissions, you can always run the extension on-demand by clicking the extension icon.
The JSON logs will immediately expand to your configured depth.
You can also click the extension icon again to expand the logs to twice the configured depth, and so on.

Configuration
You can customize the extension's expansion behavior in the options page

• Auto-expansion level: Set the maximum number of nested levels to be expanded automatically on page load (leave empty to expand all levels).
• Manual expansion level: Set the number of nested levels to be expanded when clicking the extension icon (leave empty to expand all levels).