https://community.splunk.com/t5/Getting-Data-In/Json-Event-Breaking-Issues/m-p/296601#M56235 <P>You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.</P> <P>For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag. </P> <P>Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...</P> <PRE><CODE>[ss_api2] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":) TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n TIME_PREFIX="timestamp":\s*" MAX_TIMESTAMP_LOOKAHEAD=25 </CODE></PRE> Mon, 20 Nov 2017 02:37:22 GMT maciep 2017-11-20T02:37:22Z https://community.splunk.com/t5/Getting-Data-In/Json-Event-Breaking-Issues/m-p/296600#M56234 <P>Hi Folks,</P> <P>Splunk Ent V6.5.2</P> <P>I have a curly one here. I have a Json file ( sample below).<BR /> When the file is ingested events don't always get separated. The props is on a HF.</P> <P>Thanks in advance.</P> <P>I have the following props.conf.</P> <P>[ ss_api2 ]<BR /> CHARSET=UTF-8<BR /> NO_BINARY_CHECK=true<BR /> SHOULD_LINEMERGE=false<BR /> TIME_PREFIX=timestamp<BR /> TRUNCATE = 500000<BR /> category=custom<BR /> description=Slipstream Prod/Beta api.<BR /> disabled=false<BR /> pulldown_type=true</P> <P>Json sample:</P> <P>{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\r\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable<CODE>1 parameters)\\r\\n at Autofac.Features.Indexed.KeyedServiceIndex</CODE>2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d_<EM>10.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 186\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d</EM><EM>3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.<INVOKEACTIONASYNCCORE>d</INVOKEACTIONASYNCCORE></EM><EM>0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.<CALLONACTIONEXECUTEDASYNC>d</CALLONACTIONEXECUTEDASYNC></EM><EM>5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.<CALLONACTIONEXECUTEDASYNC>d</CALLONACTIONEXECUTEDASYNC></EM><EM>5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.<EXECUTEACTIONFILTERASYNCCORE>d</EXECUTEACTIONFILTERASYNCCORE></EM><EM>0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.<EXECUTEASYNC>d</EXECUTEASYNC></EM><EM>2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.<EXECUTEASYNC>d</EXECUTEASYNC></EM><EM>0.MoveNext() MS_LoggedBy: System.Collections.Generic.List<CODE>1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"e0d465f5-8a37-47de-94c0-ad77a8e83493\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configenvironments?apptype=DigitalPlatform\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4029" }<BR /> { "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\\r\\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable</CODE>1 parameters)\r\n at Autofac.Features.Indexed.KeyedServiceIndex`2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d</EM><EM>3.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 39\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d</EM><EM>3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.<INVOKEACTIONASYNCCORE>d</INVOKEACTIONASYNCCORE></EM><EM>0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.<CALLONACTIONEXECUTEDASYNC>d</CALLONACTIONEXECUTEDASYNC></EM><EM>5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.<CALLONACTIONEXECUTEDASYNC>d</CALLONACTIONEXECUTEDASYNC></EM><EM>5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.<EXECUTEACTIONFILTERASYNCCORE>d</EXECUTEACTIONFILTERASYNCCORE></EM><EM>0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.<EXECUTEASYNC>d</EXECUTEASYNC></EM><EM>2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.<EXECUTEASYNC>d</EXECUTEASYNC></EM>_0.MoveNext() MS_LoggedBy: System.Collections.Generic.List`1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"46bee1fe-04af-40f0-97ba-1a4954f87bdd\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configscopes?apptype=DigitalPlatform&amp;scopetype=shared\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4149" }</P> Tue, 29 Sep 2020 16:53:24 GMT https://community.splunk.com/t5/Getting-Data-In/Json-Event-Breaking-Issues/m-p/296600#M56234 NickLaurent 2020-09-29T16:53:24Z https://community.splunk.com/t5/Getting-Data-In/Json-Event-Breaking-Issues/m-p/296601#M56235 <P>You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.</P> <P>For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag. </P> <P>Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...</P> <PRE><CODE>[ss_api2] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":) TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n TIME_PREFIX="timestamp":\s*" MAX_TIMESTAMP_LOOKAHEAD=25 </CODE></PRE> Mon, 20 Nov 2017 02:37:22 GMT https://community.splunk.com/t5/Getting-Data-In/Json-Event-Breaking-Issues/m-p/296601#M56235 maciep 2017-11-20T02:37:22Z