Headaches loading JSON log file

kmcarrol — Mon, 28 Sep 2020 19:57:06 GMT

My apologies if this is elementary... I know the following snippet from my JSON log file is not structurally sound but even cleaning it up by adding the proper closing braces and brackets did not help. I have two log files - one that details direct 1:1 orders (order=X, targetId=y) and the other details batch orders (order=x, targetID=a,b,c). The first is in a simple rows and columns format and I have ingested it just fine. The second is in JSON format. I can't seem to figure out how to load the file into Splunk via Add Data. I have tried both the original format and the structurally correct format below. I know how to use the multi-value commands once I get the data in. I just can't see to figure out how to get the data in. Any help would be greatly appreciated!

Original format:

5435545 {
"culture": "en-US",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "EntityIds",
"original_value": null,
"new_value": [
1067526,
1067525,
1067521,
5435547 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "ExternalReference",
"original_value": null,
"new_value": "c18a3263-f5b3-4d41-9c44-a48d00d901e9"
},
{
5436549 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "Status",
"original_value": "Created",
"new_value": "Completed"
},
{
"property": "PackageType",

Corrected format:

5435545 {
"culture": "en-US",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "EntityIds",
"original_value": null,
"new_value": [
1067526,
1067525,
1067521
]
}
]
}
5435547 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "ExternalReference",
"original_value": null,
"new_value": "c18a3263-f5b3-4d41-9c44-a48d00d901e9"
}
]
}
5436549 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "Status",
"original_value": "Created",
"new_value": "Completed"
},
{
"property": "PackageType"
}
]
}

Re: Headaches loading JSON log file

jimmpoul — Tue, 12 May 2015 15:56:38 GMT

Your corrected format is still not a valid JSON document. It has to start with a curly brace. I suggest that you make sure it is valid first in a JSON editor ex: https://www.jsoneditoronline.org/

Re: Headaches loading JSON log file

kmcarrol — Tue, 12 May 2015 17:05:37 GMT

Sure enough! Thanks a lot! I especially appreciate the reference since this is for Splunk Answers, not JSON Answers. 😉

topic Headaches loading JSON log file in Getting Data In

Headaches loading JSON log file

Re: Headaches loading JSON log file

Re: Headaches loading JSON log file