Deserialize and preview data from Kafka in DSP

When you create a data pipeline in Splunk Data Stream Processor (DSP) to ingest data from an Apache Kafka or Confluent Kafka topic using the Kafka source function, the ingested data is encoded as bytes. To view the data as human-readable strings during data preview, you must deserialize the data.

Prerequisites

To ingest data from Kafka into a DSP pipeline, you must have a connection to a Kafka broker. See Create an SSL-authenticated DSP connection to Kafka or Create an unauthenticated DSP connection to Kafka.

Steps

1. From the Data Stream Processor home page, click Build Pipeline and then select Kafka as your source function.
2. Configure the Kafka function to use your Kafka connection and get data from your Kafka topic. See Get data from Kafka.
3. On the pipeline canvas, click the + icon next to the Kafka function and then select Eval from the function picker.
4. On the View Configurations tab, enter the following SPL2 expression in the function field:

   value=to_string(value)
   

5. Click Start Preview and click the Eval function on the pipeline canvas to confirm that the data in the value field has been deserialized from bytes into strings.
6. (Optional) Click Stop Preview and continue building your pipeline by adding new functions to it.