topic Parsing Multimetric Logs in Getting Data In

Parsing Multimetric Logs

grexo94 — Tue, 04 Nov 2025 11:32:25 GMT

Hi all,I am trying to parse multiple nested Multimetric logs as metrics and am failing.The following source type works when I read logs individually, e.g.

{"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1}

or pretty printed:

{
      "event": "metric",
      "metric_name:my_metric_1": 2.0,
      "metric_name:my_metric_2": 2.1
    }[json_metrics_singleevent]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = JSON
KV_MODE = none

____________________________________________________________________________
in reality, logs look like this:
{"data":[{"event":"metric","metric_name:my_metric_1":0,"metric_name:my_metric_2":0.1},{"event":"metric","metric_name:my_metric_1":1,"metric_name:my_metric_2":1.1},{"event":"metric","metric_name:my_metric_1":2,"metric_name:my_metric_2":2.1}]}or pretty printed:{
  "data": [
    {
      "event": "metric",
      "metric_name:my_metric_1": 0.0,
      "metric_name:my_metric_2": 0.1
    },
    {
      "event": "metric",
      "metric_name:my_metric_1": 1.0,
      "metric_name:my_metric_2": 1.1
    },
    {
      "event": "metric",
      "metric_name:my_metric_1": 2.0,
      "metric_name:my_metric_2": 2.1
    }
  ]
}

Sourcetype:

[json_metrics_multievents]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = JSON
LINE_BREAKER = (\{\"data\"\:\[)|(\,)\{"event|(\]\})

--> doesn't work. I am getting the response, the logs are not properly structured.Can someone help please?

Re: Parsing Multimetric Logs

VatsalJagani — Sat, 08 Nov 2025 13:22:37 GMT

@grexo94 - Basically, I think the problem you have is with JSON List. There are two approaches that I could think of from which you can start:

HEC
- If you are already using HEC for data ingestion, OR If you have ingestion flexibility on how you ingest data, and you can convert existing ingestion into a HEC data sending script
- In this case, you can basically programatically handle JSON List properly to put each entry in its own event and send it to Splunk individually into a separate metric event.
- https://help.splunk.com/en/splunk-enterprise/get-data-in/metrics/9.2/get-metrics-data-in/get-metrics-in-from-other-sources
Ingest Processor
- If you don't have flexibility in ingestion, you can use the Ingest Processor of Splunk to convert JSON List into individual JSON events (metrics) to be ingested separately.
- https://lantern.splunk.com/Platform_Data_Management/Transform_Pipelines/Using_Ingest_Processor_to_convert_JSON_logs_into_metrics

I hope this helps!!!

Re: Parsing Multimetric Logs

grexo94 — Fri, 14 Nov 2025 10:09:56 GMT

thank you, yes, these will be my plan b & c's.

I was wondering why i simply cannot use a linebreaker the way i am used to for event-indexing, but i simply accept that for logs that i want to index as metrics