topic Re: Line Break Assistance required in All Apps and Add-ons

Line Break Assistance required

sumanssah — Sat, 08 Feb 2020 14:23:50 GMT

Hello Splunkers, required yous assistance with a line break for below-mentioned logs at ],[

{"time":1581014469,"states":[["4b1803","SWR55X ","Switzerland",1581014469,1581014469,8.7818,46.8227,6880.86,false,206.91,354.01,-7.8,null,7063.74,"1000",false,0],["3cf0a4","IFA509 ","Germany",1581014469,1581014469,7.9657,46.878,8534.4,false,143.86,32.44,0,null,8679.18,"5344",false,0],["3c6758","DLH1333 ","Germany",1581014469,1581014469,8.545,47.7009,11582.4,false,212.56,30.23,0,null,11681.46,"1030",false,0],["3c5442","DLH02J ","Germany",1581014469,1581014469,6.6594,46.3485,10363.2,false,226.41,39.01,0,null,10492.74,"1000",false,0],["3c658e","DLH15U ","Germany",1581014468,1581014469,9.0273,46.5254,10355.58,false,229.56,358.2,0,null,10347.96,"1000",false,0],["4a8159","SCW3P ","Sweden",1581014469,1581014469,6.9469,46.9315,8557.26,false,221.02,229.15,-10.08,null,8557.26,"0763",false,0],["440344","LDM74J ","Austria",1581014469,1581014469,10.1866,46.0682,5631.18,false,197.18,242.83,-14.96,null,5814.06,"4131",false,0]

current props.conf used for above-mentioned logs is (REST mechanism is used for data integration)

[ geomonitor]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n,])\["
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Thanks in advance

Re: Line Break Assistance required

richgalloway — Sat, 08 Feb 2020 17:42:44 GMT

Try LINE_BREAKER = ](,)\[.

Re: Line Break Assistance required

sumanssah — Sun, 09 Feb 2020 05:52:11 GMT

no working 😞 with

](,)[

Re: Line Break Assistance required

abhijeet01 — Sun, 09 Feb 2020 08:19:41 GMT

Try

LINE_BREAKER = ]\,[

Re: Line Break Assistance required

to4kawa — Sun, 09 Feb 2020 10:31:32 GMT

LINE_BREAKER = \[|\](,)

LINE_BREAKER = \[|\](,)
SEDCMD-json_trim = s/(?s){.*//

how about this?

Re: Line Break Assistance required

richgalloway — Sun, 09 Feb 2020 13:34:00 GMT

The backslash is necessary.

Re: Line Break Assistance required

sumanssah — Thu, 13 Feb 2020 17:47:00 GMT

As per investigation and testing, able to achieve the required result with

Event Extraction Setting in "Add-on Builder App"

json path 
 $.states[*][1]

Re: Line Break Assistance required

to4kawa — Thu, 13 Feb 2020 21:13:56 GMT

where's the setting?