topic json sourcetype failed to act correctly in Deployment Architecture

json sourcetype failed to act correctly

fatemebayat — Tue, 29 Sep 2020 14:14:17 GMT

hi everyone
i have a problem with events with sourcetype=json.
when i send several logs to splunk in json format less than aorund 30s, logs aggregated in one event.
WHY?
but when i use sourcetype=json_no_timestamp, every events correct and seperated.
can i help me , how can i solve my problem?

Re: json sourcetype failed to act correctly

hettervik — Wed, 24 May 2017 09:08:54 GMT

Hi. Maybe a stupid answer, but you know it should be sourcetype=_json, and not simply json?

Re: json sourcetype failed to act correctly

fatemebayat — Tue, 29 Sep 2020 14:14:28 GMT

hi hettervi
thanks for your attention.
yes, in know it :). sourcetype is _json.
finally i solved it.
in setting -> source types -> _json, i added below setting.
-SHOULD_LINEMERGE= false
-AUTO_KV_JSON = false
-KV_MODE = none
and timestamp in auto mode and has a structure like this (Wed May 24 09:30:00.555 UTC 2017).