How to configure props.conf to parse JSON data structures?

carlskii — Wed, 17 Sep 2014 20:19:55 GMT

Hi,

I have the following JSON data structure which I'm trying to parse as three separate events. Can somebody please show how a should define my props.conf. This is what I currently have but its only extracting a single event.

[fruits_source]
KV_MODE = json
LINE_BREAKER = "(^){"
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = false

json data.

{
    "fruits": [
        {
            "fruit": "orange",
            "location": "tray1",
            "date": "6/20/2014",
            "instances_1": [
                {
                    "name": "orange",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ],
            "instances_2": [
                {
                    "name": "orange",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "orange",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "orange",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ]
        },
        {
            "fruit": "lemon",
            "location": "tray2",
            "date": "6/20/2015",
            "instances_1": [
                {
                    "name": "a",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ],
            "instances_2": [
                {
                    "name": "a",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "b",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "c",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ]
        },
        {
            "fruit": "clementine",
            "location": "tray3",
            "date": "6/20/2016",
            "instances_1": [
                {
                    "name": "a",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ],
            "instances_2": [
                {
                    "name": "a",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "b",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                },
                {
                    "name": "c",
                    "type": "citrus",
                    "shape": "round",
                    "status": "ok"
                }
            ]
        }
    ]
}

Re: How to configure props.conf to parse JSON data structures?

carlskii — Wed, 17 Sep 2014 20:21:52 GMT

BTW I'm using Splunk 6.1.3

Re: How to configure props.conf to parse JSON data structures?

sowings — Fri, 19 Sep 2014 22:43:10 GMT

LINE_BREAKER has to have something to consume, and ^ is an anchor, not a character per se. Try the following instead.

LINE_BREAKER = ([<BACKSLASH>n<BACKSLASH>r]+){

Replace the <BACKSLASH> with a literal backslash character (I can't get it to display on the forum text for some reason).

This says "break on a newline followed immediately by a { character".

topic How to configure props.conf to parse JSON data structures? in Getting Data In

How to configure props.conf to parse JSON data structures?

Re: How to configure props.conf to parse JSON data structures?

Re: How to configure props.conf to parse JSON data structures?