https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112009#M23471 <P>Yes, but it did not work. Looks like this is not 100% correct json and the kv_mode=json won't recognize it. I'm working with the data provider to see if they can correct the issue</P> Fri, 05 Sep 2014 13:35:08 GMT jedatt01 2014-09-05T13:35:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112006#M23468 <P>I have events that are coming in 'kinda' json format. I can't get KV_MODE=json to work so I was going to try and do the line breaking and field extraction manually. 2 sample events below. Please help. </P> <PRE><CODE>{ "_id" : ObjectId("123456"), "notificationId" : 1234567, "notificationTime" : "4/9/2014 10:05:41 AM", "user" : { "userId" : 1235, "userType" : "New Member", "identifiers" : [ { "identifier" : "123456", "identifierType" : "Entity Key" }, { "identifier" : "123456", "identifierType" : "GenKey" } ], "createdOnDate" : "2014-04-02T14:18:49-04:00" }, "devices" : [ { "activity" : [ { "d1" : "0", "d2" : "0", "c1" : "0", "s1" : "0", "day" : "4/8/2014 12:00:00 AM" }, { "d1" : "0", "d2" : "0", "c1" : "0", "s1" : "0", "day" : "4/9/2014 12:00:00 AM" } ], "deviceId" : "1234567" } ], "__v" : 0 }, </CODE></PRE> <HR /> <PRE><CODE>{ "_id" : ObjectId("123456"), "notificationId" : 1234567, "notificationTime" : "4/9/2014 10:05:41 AM", "user" : { "userId" : 1235, "userType" : "New Member", "identifiers" : [ { "identifier" : "123456", "identifierType" : "Entity Key" }, { "identifier" : "123456", "identifierType" : "GenKey" } ], "createdOnDate" : "2014-04-02T14:18:49-04:00" }, "devices" : [ { "activity" : [ { "d1" : "0", "d2" : "0", "c1" : "0", "s1" : "0", "day" : "4/8/2014 12:00:00 AM" }, { "d1" : "0", "d2" : "0", "c1" : "0", "s1" : "0", "day" : "4/9/2014 12:00:00 AM" } ], "deviceId" : "1234567" } ], "__v" : 0 }, </CODE></PRE> Thu, 04 Sep 2014 17:55:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112006#M23468 jedatt01 2014-09-04T17:55:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112007#M23469 <P>I'm no json expert. Normally for json in splunk you want to arrange for your events to be valid complete json items, whether that's a the entirety of the original json document, or a subcomponent.</P> <P>This typically is more of a question of "how can I get splunk to keep this component of my json blob as an event", where linebreaking is how to identify a unit of information in a file. Typically linebreaking just identifies lines, and event merging combines them to form events. There are times where "abusing" linebreaking to make each line an event may be easier to configure though.</P> Thu, 04 Sep 2014 22:17:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112007#M23469 jrodman 2014-09-04T22:17:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112008#M23470 <P>Have you tried to set the sourcetype to <STRONG>_json</STRONG> ? (this sourcetype definition ships with Splunk)</P> Thu, 04 Sep 2014 23:43:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112008#M23470 Damien_Dallimor 2014-09-04T23:43:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112009#M23471 <P>Yes, but it did not work. Looks like this is not 100% correct json and the kv_mode=json won't recognize it. I'm working with the data provider to see if they can correct the issue</P> Fri, 05 Sep 2014 13:35:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112009#M23471 jedatt01 2014-09-05T13:35:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112010#M23472 <P>I'm experiencing same issue. Have you got any results?</P> Wed, 25 May 2016 08:43:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-props-conf-to-line-break-data-in-json-format/m-p/112010#M23472 Sanjai676 2016-05-25T08:43:12Z