JSON Data extraction issues with Comma

kumva01 — Tue, 29 Oct 2024 14:08:40 GMT

Hi Team,

We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object should be recognized as a separate event, but the configuration is not breaking them apart as expected

I observed that each JSON object has a comma after the closing brace }, which appears to be causing the issue by preventing Splunk from treating each JSON object as a separate event.

sample data :

{ "timestamp":"1727962122", "phonenumber": "0000000" "appname": "cisco" }, { "timestamp":"1727962123", "phonenumber": "0000000" "appname": "windows" },

Error message : Error message : JSON StreamID:0 had parsing error: Unexpected character while looking for value comma ','

Thanks in advance

Re: JSON Data extraction issues with Comma

tej57 — Wed, 18 Jun 2025 07:19:52 GMT

Hello @kumva01,

Can you explain more about what is the source and how are you trying to ingest the data? What will be the data flow? Just the props configuration will not be able to help you with breaking the events and maintaining the JSON format for further field extractions.

Thanks,
Tejas.

topic Re: JSON Data extraction issues with Comma in Getting Data In

JSON Data extraction issues with Comma

Re: JSON Data extraction issues with Comma