https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-my-JSON-string-breaking-into-events/m-p/194715#M38760 <P>try including a timestamp for each event,I Think that will help,as Splunk undestands or breaks mostly by timestamp</P> Thu, 03 Mar 2016 22:23:15 GMT vrmandadi 2016-03-03T22:23:15Z https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-my-JSON-string-breaking-into-events/m-p/194714#M38759 <P>Hello all! I'm trying to break this huge JSON string into multiple events into Splunk. For some reason, my props.conf configs aren't working. It returns the entire large JSON string.</P> <P>Props.conf:</P> <PRE><CODE>[locu_philly] KV_Mode = json LINE_BREAKER = \{(.*?)\}, NO_BINARY_CHECK = 1 Truncate = 0 SHOULD_LINEMERGER = false </CODE></PRE> <P>JSON Sample:</P> <PRE><CODE>{u'name': u'Steaks on South', u'locality': u'Philadelphia', u'website_url': u'http://www.steaksonsouth.com/', u'cuisines': [], u'region': u'PA', u'long': -75.148055, u'phone': u'(215) 922-7880', u'postal_code': u'19147', u'categories': [u'restaurant'], u'has_menu': True, u'country': u'United States', u'lat': 39.941416, u'id': u'000923d517a59ae48e8a', u'street_address': u'308 South St.', u'resource_uri': u'/v1_0/venue/000923d517a59ae48e8a/'}, {u'name': u'Olive Branch', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.171997, u'phone': u'(215) 636-0804', u'postal_code': None, u'categories': [u'other', u'restaurant'], u'has_menu': False, u'country': u'United States', u'lat': 39.952499, u'id': u'00099e85007bf6290dc6', u'street_address': u'38 S. 19th St.', u'resource_uri': u'/v1_0/venue/00099e85007bf6290dc6/'}, {u'name': u'New China Court', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.1948377868302, u'phone': u'(215) 247-1708', u'postal_code': u'19118', u'categories': [u'restaurant'], u'has_menu': False, u'country': u'United States', u'lat': 40.0733706492276, u'id': u'00133feee8816eb4425e', u'street_address': u'7700 Crittenden St.', u'resource_uri': u'/v1_0/venue/00133feee8816eb4425e/'}, {u'name': u'K Laundromat', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.131135, u'phone': u'(215) 324-4232', u'postal_code': u'19140', u'categories': [u'other', u'laundry'], u'has_menu': False, u'country': u'United States', u'lat': 40.014534, u'id': u'001743eaf1595d4b6b8a', u'street_address': u'4201 Rising Sun Ave.', u'resource_uri': u'/v1_0/venue/001743eaf1595d4b6b8a/'} </CODE></PRE> Thu, 15 Jan 2015 23:37:49 GMT https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-my-JSON-string-breaking-into-events/m-p/194714#M38759 ashnet16 2015-01-15T23:37:49Z https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-my-JSON-string-breaking-into-events/m-p/194715#M38760 <P>try including a timestamp for each event,I Think that will help,as Splunk undestands or breaks mostly by timestamp</P> Thu, 03 Mar 2016 22:23:15 GMT https://community.splunk.com/t5/Getting-Data-In/Why-isn-t-my-JSON-string-breaking-into-events/m-p/194715#M38760 vrmandadi 2016-03-03T22:23:15Z