https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651553#M110654 <P>Thanks a lot for the advice!</P><P>My concern was the multi-line-ness of the json, but I realize now I Can just output as a single line and that should be fine to append.</P> Fri, 21 Jul 2023 20:06:48 GMT rufflabs 2023-07-21T20:06:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651539#M110648 <P>I have a script that I am generating a json formatted log file entries. I want to get this data into Splunk. What is the best way to write the data to disk to be monitored and ingested?</P> <P>Should I just append json data into a single file, or should the log file have only one entry at a time, and I overwrite/clear the file each time I need to add new data?</P> <P>&nbsp;</P> Fri, 21 Jul 2023 18:28:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651539#M110648 rufflabs 2023-07-21T18:28:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651541#M110649 <P>You should normally append to the log file. This helps Splunk keep track of what it has already ingested and not miss anything in case where the forwarder is slow (for some reason) and you overwrite the entry before Splunk has picked it up.</P> Fri, 21 Jul 2023 18:31:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651541#M110649 ITWhisperer 2023-07-21T18:31:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651547#M110652 <P>Adding to <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a> 's answer - you might want to keep your jsons single-line and keep each of them in separate lines - that greatly helps with splitting the stream into single events. With multiline events finding where one event ends and another starts can get tricky.</P> Fri, 21 Jul 2023 19:02:45 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651547#M110652 PickleRick 2023-07-21T19:02:45Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651553#M110654 <P>Thanks a lot for the advice!</P><P>My concern was the multi-line-ness of the json, but I realize now I Can just output as a single line and that should be fine to append.</P> Fri, 21 Jul 2023 20:06:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651553#M110654 rufflabs 2023-07-21T20:06:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651623#M110673 This also saves license as there are no line breaks and additional spaces for formatting it nicely. Sat, 22 Jul 2023 17:16:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-json-log-data-to-be-ingested/m-p/651623#M110673 isoutamo 2023-07-22T17:16:51Z