<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Another JSON Event Break Assistance request .. in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Another-JSON-Event-Break-Assistance-request/m-p/354330#M64798</link>
    <description>&lt;P&gt;An excerpt from my JSON output ...&lt;/P&gt;

&lt;P&gt;Trying to Event break at the following line  "type": "story", where a new event begins.&lt;/P&gt;

&lt;P&gt;Have tried several posts but cannot get it working currently.&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
  "total_count": 195,&lt;BR /&gt;
  "data": [&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-09-06T01:29:57Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "45003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 18,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "14001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "21001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 4,&lt;BR /&gt;
      "id": "41051",&lt;BR /&gt;
      "last_modified": "2017-09-18T05:30:31Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4029"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13010"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": null,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "Add portlet to PSR - tasks planned and milestones",&lt;BR /&gt;
      "estimated_hours": 9&lt;BR /&gt;
    },&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-07-31T02:08:15Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "26056"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 15,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "12002"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "19003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 0,&lt;BR /&gt;
      "id": "28001",&lt;BR /&gt;
      "last_modified": "2017-08-31T03:13:37Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4030"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13010"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": 0,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "As a  PM, I can manage Projects of the NEC DTS Project Type",&lt;BR /&gt;
      "estimated_hours": 0&lt;BR /&gt;
    },&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-07-21T05:11:24Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "23069"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 14,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "12002"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "19003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 1,&lt;BR /&gt;
      "id": "26060",&lt;BR /&gt;
      "last_modified": "2017-08-04T03:02:16Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4030"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "6001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "1008"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": 1,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "As a BA I can assign requirements to PPM work packages. (many to many relationship)",&lt;BR /&gt;
      "estimated_hours": 1&lt;BR /&gt;
    },&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 15:54:39 GMT</pubDate>
    <dc:creator>Esky73</dc:creator>
    <dc:date>2020-09-29T15:54:39Z</dc:date>
    <item>
      <title>Another JSON Event Break Assistance request ..</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Another-JSON-Event-Break-Assistance-request/m-p/354330#M64798</link>
      <description>&lt;P&gt;An excerpt from my JSON output ...&lt;/P&gt;

&lt;P&gt;Trying to Event break at the following line  "type": "story", where a new event begins.&lt;/P&gt;

&lt;P&gt;Have tried several posts but cannot get it working currently.&lt;/P&gt;

&lt;P&gt;{&lt;BR /&gt;
  "total_count": 195,&lt;BR /&gt;
  "data": [&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-09-06T01:29:57Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "45003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 18,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "14001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "21001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 4,&lt;BR /&gt;
      "id": "41051",&lt;BR /&gt;
      "last_modified": "2017-09-18T05:30:31Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4029"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13010"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": null,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "Add portlet to PSR - tasks planned and milestones",&lt;BR /&gt;
      "estimated_hours": 9&lt;BR /&gt;
    },&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-07-31T02:08:15Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "26056"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 15,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "12002"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "19003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 0,&lt;BR /&gt;
      "id": "28001",&lt;BR /&gt;
      "last_modified": "2017-08-31T03:13:37Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4030"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13010"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "13001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": 0,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "As a  PM, I can manage Projects of the NEC DTS Project Type",&lt;BR /&gt;
      "estimated_hours": 0&lt;BR /&gt;
    },&lt;BR /&gt;
    {&lt;BR /&gt;
      "type": "story",&lt;BR /&gt;
      "creation_time": "2017-07-21T05:11:24Z",&lt;BR /&gt;
      "parent": {&lt;BR /&gt;
        "type": "feature",&lt;BR /&gt;
        "id": "23069"&lt;BR /&gt;
      },&lt;BR /&gt;
      "version_stamp": 14,&lt;BR /&gt;
      "release": {&lt;BR /&gt;
        "type": "release",&lt;BR /&gt;
        "id": "12002"&lt;BR /&gt;
      },&lt;BR /&gt;
      "sprint": {&lt;BR /&gt;
        "type": "sprint",&lt;BR /&gt;
        "id": "19003"&lt;BR /&gt;
      },&lt;BR /&gt;
      "description": null,&lt;BR /&gt;
      "invested_hours": 1,&lt;BR /&gt;
      "id": "26060",&lt;BR /&gt;
      "last_modified": "2017-08-04T03:02:16Z",&lt;BR /&gt;
      "phase": {&lt;BR /&gt;
        "type": "phase",&lt;BR /&gt;
        "id": "4030"&lt;BR /&gt;
      },&lt;BR /&gt;
      "owner": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "6001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "author": {&lt;BR /&gt;
        "type": "workspace_user",&lt;BR /&gt;
        "id": "1008"&lt;BR /&gt;
      },&lt;BR /&gt;
      "story_points": 1,&lt;BR /&gt;
      "product_areas": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "team": {&lt;BR /&gt;
        "type": "team",&lt;BR /&gt;
        "id": "4001"&lt;BR /&gt;
      },&lt;BR /&gt;
      "remaining_hours": 0,&lt;BR /&gt;
      "user_tags": {&lt;BR /&gt;
        "total_count": 0,&lt;BR /&gt;
        "data": []&lt;BR /&gt;
      },&lt;BR /&gt;
      "name": "As a BA I can assign requirements to PPM work packages. (many to many relationship)",&lt;BR /&gt;
      "estimated_hours": 1&lt;BR /&gt;
    },&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 15:54:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Another-JSON-Event-Break-Assistance-request/m-p/354330#M64798</guid>
      <dc:creator>Esky73</dc:creator>
      <dc:date>2020-09-29T15:54:39Z</dc:date>
    </item>
    <item>
      <title>Re: Another JSON Event Break Assistance request ..</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Another-JSON-Event-Break-Assistance-request/m-p/354331#M64799</link>
      <description>&lt;P&gt;Solved it with the following .. and the KV_MODE extracts all the fields as well.&lt;/P&gt;

&lt;P&gt;[ octane_json ]&lt;BR /&gt;
BREAK_ONLY_BEFORE=(^)\s{4}{&lt;BR /&gt;
CHARSET=UTF-8&lt;BR /&gt;
KV_MODE=json&lt;BR /&gt;
NO_BINARY_CHECK=true&lt;BR /&gt;
SHOULD_LINEMERGE=true&lt;BR /&gt;
category=Custom&lt;BR /&gt;
description=JavaScript Object Notation format. For more information, visit &lt;A href="http://json.org/" target="_blank"&gt;http://json.org/&lt;/A&gt;&lt;BR /&gt;
disabled=false&lt;BR /&gt;
pulldown_type=true&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 15:54:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Another-JSON-Event-Break-Assistance-request/m-p/354331#M64799</guid>
      <dc:creator>Esky73</dc:creator>
      <dc:date>2020-09-29T15:54:42Z</dc:date>
    </item>
  </channel>
</rss>

