https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214066#M42083 <P>I tried using the same UI sourcetype with CLI ,but it did not work,If you could help me with the sourcetype for CLI that would be great</P> Mon, 22 Feb 2016 02:27:57 GMT vrmandadi 2016-02-22T02:27:57Z https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214064#M42081 <P>Hello Experts,</P> <P>Attached is the sample JSON file which I am trying to upload to Splunk.I have uploaded it by Splunk WEB and it broke the events successfully but when I am trying to upload via CLI it is taking all 8 events into a single event.Can you please help how to break those events(8).</P> Sat, 20 Feb 2016 20:20:25 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214064#M42081 vrmandadi 2016-02-20T20:20:25Z https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214065#M42082 <P>When you upload the data via the UI, Splunk detects the source file format and assigns a sourcetype that makes sense. In this case, probably <STRONG>_json</STRONG><BR /> If you want to achieve the same result via the command line, you need to configure and specify a sourcetype with the proper settings for your json data. When you are using the command line, you have to replace some of the smarts of the UI with manual actions.<BR /> I'd recommend reading (at least) <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Overviewofeventprocessing">this chapter of the Getting Data In manual</A> to understand how Splunk processes data. </P> <P>You can also go through the UI once, then save the sourcetype settings under a new name you chose, and then use that sourcetype on subsequent CLI uploads.</P> Sun, 21 Feb 2016 10:33:08 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214065#M42082 s2_splunk 2016-02-21T10:33:08Z https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214066#M42083 <P>I tried using the same UI sourcetype with CLI ,but it did not work,If you could help me with the sourcetype for CLI that would be great</P> Mon, 22 Feb 2016 02:27:57 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-break-the-JSON-data/m-p/214066#M42083 vrmandadi 2016-02-22T02:27:57Z