https://community.splunk.com/t5/Getting-Data-In/JSON-line-breaking-How-do-I-get-rid-of-the/m-p/608267#M105552 <P>Use SEDCMD to remove the unwanted character.</P><LI-CODE lang="markup">SEDCMD-rmbracket = s/\]$//</LI-CODE> Thu, 04 Aug 2022 12:25:06 GMT richgalloway 2022-08-04T12:25:06Z https://community.splunk.com/t5/Getting-Data-In/JSON-line-breaking-How-do-I-get-rid-of-the/m-p/608248#M105549 <P>Hi Team I have a JSON file as below :-</P> <LI-CODE lang="markup">[{"entityId":null,"entityType":"Account.AccountRequest","accessedByUser":"jinghui@bullish.treasurygo.com","milestone":"Approval","comment":"Bank Account Manager approved this request. Comments: ","commentType":"MilestoneApproval","when":"2022-07-26T06:10:43.91Z","id":30},{"entityId":null,"entityType":"Account.AccountRequest","accessedByUser":"jinghui@bullish.treasurygo.com","milestone":"Approval","comment":"Bank Account Manager approved this request. Comments: ","commentType":"MilestoneApproval","when":"2022-07-26T06:10:43.91Z","id":30},{"entityId":null,"entityType":"Account.AccountRequest","accessedByUser":"jinghui@bullish.treasurygo.com","milestone":"A task was completed","comment":"Prepare SAP Config Docs","commentType":"MilestoneGeneric","when":"2022-07-26T06:10:43.907Z","id":29},{"entityId":null,"entityType":"Account.AccountRequest","accessedByUser":"jinghui@bullish.treasurygo.com","milestone":"A task was completed","comment":"Prepare SAP Config Docs","commentType":"MilestoneGeneric","when":"2022-07-26T06:10:43.907Z","id":29}] </LI-CODE> <P>I am using the pattern while testing and reviewing the events :-<BR />(\[|,|\]){</P> <P>This breaks everything fine but the last line which has the closing ]</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chandvit_0-1659608177437.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/20855i04F69707968C5E3A/image-size/medium?v=v2&amp;px=400" role="button" title="chandvit_0-1659608177437.png" alt="chandvit_0-1659608177437.png" /></span></P> <P>&nbsp;</P> <P>How to get rid of the ] at the end of the JSON array?</P> <P>Kindly request you'll to guide me.Many thanks in anticipation.</P> Thu, 04 Aug 2022 14:46:55 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-line-breaking-How-do-I-get-rid-of-the/m-p/608248#M105549 chandvit 2022-08-04T14:46:55Z https://community.splunk.com/t5/Getting-Data-In/JSON-line-breaking-How-do-I-get-rid-of-the/m-p/608267#M105552 <P>Use SEDCMD to remove the unwanted character.</P><LI-CODE lang="markup">SEDCMD-rmbracket = s/\]$//</LI-CODE> Thu, 04 Aug 2022 12:25:06 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-line-breaking-How-do-I-get-rid-of-the/m-p/608267#M105552 richgalloway 2022-08-04T12:25:06Z