topic Re: Json file getting truncated in Getting Data In

Json file getting truncated

dpatiladobe — Tue, 29 Sep 2020 15:53:21 GMT

Below is my i/p file
{
"Count": 2,
"Items": [
{
"total_time": {
"S": "0.000s"
},
"start_date_time": {
"S": "2017-09-19 05:00:43"
},
"bad_records": {
"N": "0"
},
"successful_records": {
"N": "0"
},
"source": {
"S": "mps_dnc"
},
"end_date_time": {
"S": "2017-09-19 05:00:43"
},
"file_name": {
"S": "No File"
},
"total_records": {
"N": "0"
},
"job_name": {
"S": "mps_dnc_out"
}
},
{
"total_time": {
"S": "12.783s"
},
"start_date_time": {
"S": "2017-09-19 11:42:21"
},
"bad_records": {
"N": "0"
},
"successful_records": {
"N": "12094"
},
"source": {
"S": "mps_dnc"
},
"end_date_time": {
"S": "2017-09-19 11:42:34"
},
"file_name": {
"S": "do_not_contact_list_2017-09-19T11_42_20.581Z.txt"
},
"total_records": {
"N": "12094"
},
"job_name": {
"S": "mps_dnc_out"
}
}
],
"ScannedCount": 2,
"ConsumedCapacity": null
}

Below is my probs.conf and limit .conf
[spath]

number of characters to read from an XML or JSON event when auto extracting

extraction_cutoff = 10000

cat props.conf

[dynamoout]
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)
DATETIME_CONFIG = CURRENT

[source::/script_logs_mps/.]
CHECK_METHOD=entire_md5

Still on splunk i can see only 8 lines.

Re: Json file getting truncated

somesoni2 — Wed, 20 Sep 2017 02:35:23 GMT

Try this for your props.conf (on indexer/heavy forwarder)

[dynamoout]
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=\{)
DATETIME_CONFIG = CURRENT

[dynamoout]
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG = CURRENT

Re: Json file getting truncated

dpatiladobe — Tue, 29 Sep 2020 15:53:50 GMT

With below setting i can see the json extract working fine
I tried same yesterday but did not worked It is working today. Thanks for your help.
[dynamoout]
TRUNCATE = 0
KV_MODE = json
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG = CURRENT