topic Re: Why does a single, short json file create multiple events in Splunk? in Getting Data In

Why does a single, short json file create multiple events in Splunk?

shawny2005 — Thu, 09 Feb 2017 00:42:58 GMT

I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?

I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.

Re: Why does a single, short json file create multiple events in Splunk?

shawny2005 — Thu, 09 Feb 2017 00:43:41 GMT

http://imgur.com/a/LPpJr

Re: Why does a single, short json file create multiple events in Splunk?

shawny2005 — Thu, 09 Feb 2017 00:44:35 GMT

above is link to the way it looks in search.

Re: Why does a single, short json file create multiple events in Splunk?

mpreddy — Thu, 09 Feb 2017 01:22:41 GMT

Can you post some sample data.

if you want to combine total json file in to single event Give a try using this property in props.conf

SHOULD_LINEMERGE= TRUE

Re: Why does a single, short json file create multiple events in Splunk?

satishsdange — Thu, 09 Feb 2017 05:53:48 GMT

please refer this post - https://answers.splunk.com/answers/227596/why-am-i-seeing-a-mismatch-between-key-value-and-c.html

Re: Why does a single, short json file create multiple events in Splunk?

shawny2005 — Thu, 09 Feb 2017 16:51:29 GMT

I think this is a different problem.

Re: Why does a single, short json file create multiple events in Splunk?

shawny2005 — Thu, 09 Feb 2017 16:51:53 GMT

This is enabled True on defaults and I don't see any thing overriding it.

Re: Why does a single, short json file create multiple events in Splunk?

shawny2005 — Fri, 10 Feb 2017 18:55:59 GMT

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.