topic Re: Issue with a log JSON in Getting Data In

Issue with a log JSON

rafamss — Tue, 11 Feb 2014 15:27:49 GMT

Hi guys,

I'm having a issues with a log data file in the following format (JSON):

{"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 250, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 100, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 250, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 700, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 500, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 240, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 100, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }} {"widget": { "debug": "on", "window": { "title": "Sample Konfabulator Widget", "name": "main_window", "width": 600, "height": 500 }, "image": { "src": "Images/Sun.png", "name": "sun1", "hOffset": 950, "vOffset": 250, "alignment": "center" }, "text": { "data": "Click Here", "size": 36, "style": "bold", "name": "text1", "hOffset": 250, "vOffset": 190, "alignment": "center", "onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;" } }}

The Splunk only recognizes the file as a unique line. What do I do ?

Rafael Martins

Re: Issue with a log JSON

somesoni2 — Tue, 11 Feb 2014 15:35:54 GMT

You've create data input from Splunk Web or directly from props.conf?

Re: Issue with a log JSON

rafamss — Tue, 11 Feb 2014 16:24:56 GMT

I created through Splunk Web.

Re: Issue with a log JSON

somesoni2 — Tue, 11 Feb 2014 16:30:59 GMT

did you configure the event breaking or your just went ahead with default values?

Re: Issue with a log JSON

rafamss — Tue, 11 Feb 2014 16:39:12 GMT

I created a new source type and inserted the data log file into directory that was already previously configured. I consider this is the simplest way to do this.

Re: Issue with a log JSON

somesoni2 — Tue, 11 Feb 2014 17:21:34 GMT

Since your data don't have timestamp (for each event), SPlunk is considering whole file content as one event. When seeing the preview of the log file during import, click on 'adjust timestamp and event break settings' link (in top section). Then in 'Event breaks' tab, select option "specify patter..." and provide this value {"widget" . Click on apply and continue with other things that your were doing so far.

Re: Issue with a log JSON

rafamss — Tue, 11 Feb 2014 18:20:28 GMT

Hi somesoni2, Your example worked fine. Thanks!

Re: Issue with a log JSON

rafamss — Tue, 11 Feb 2014 18:22:01 GMT

Hi somesoni2, Your example worked fine. Thanks!