topic Re: Event Break JSON in Getting Data In

Event Break JSON

thufirtan — Mon, 25 Mar 2013 09:25:54 GMT

Hi, I am trying to ingest JSON data into Splunk but I am having difficulties setting up the event breaks. What is the best way to do this?

Re: Event Break JSON

Jordan_Brough — Sat, 29 Jun 2013 16:08:29 GMT

Assuming that each json event blob starts on a new line with an opening brace { Then this seems to be working for me:

[json]
KV_MODE = json
LINE_BREAKER = "(^){"
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = false

Re: Event Break JSON

niordache — Thu, 03 Oct 2013 14:05:25 GMT

Worked for me ! Json object is not splitted in several events .

Re: Event Break JSON

lpolo — Wed, 19 Feb 2014 15:20:09 GMT

I used this approach to address my question:

http://answers.splunk.com/answers/121098/iterate-the-extraction-of-json-objects-using-splunk-query-language

However, I think that this approach has the problem that the json objects are not split into events. Therefore, any aggregation function will not work as expected. Any idea?

Re: Event Break JSON

sbitterman — Thu, 09 Apr 2015 15:38:53 GMT

Where did you specify this logic? In your $SPUNK_HOME/etc/system/local/props.conf? That's where I'm trying to define this logic to get my events correct when using the Splunk Forwarder, but not having any success. 😞

Re: Event Break JSON

RaistlinLinden — Wed, 01 Jul 2015 23:55:55 GMT

I would really like to know the answer to this as we are having the same problem. We are using the splunk cloud and do not know where to put this logic. On a config file on the cloud server?

Re: Event Break JSON

mjoseff_splunk — Wed, 05 Oct 2016 18:19:10 GMT

$SPLUNK_HOME/etc/system/local/props.conf