<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do you remove a header from JSON? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378983#M68518</link>
    <description>&lt;P&gt;Hi all&lt;/P&gt;

&lt;P&gt;I'm ingesting some JSON via REST API, but the events are all squashed into one large event.  I'm pretty sure it's because there is a header at the top of the file that needs to be removed for the JSON to be parsed correctly.&lt;/P&gt;

&lt;P&gt;I think, again, I need to add SEDCMD to the props, but I'm unsure of the regex required.   Any help would be appreciated — below is a sample of the JSON.  The bold section is the header.&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;{"location":{"name":"Adlington (Lancashire)","crs":"ADL","tiploc":"ADNL"},"filter":null,"services":&lt;/STRONG&gt;[{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2006","gbttBookedDeparture":"2006","origin":[{"tiploc":"BLCKPLN","description":"Blackpool North","workingTime":"191600","publicTime":"1916"},{"tiploc":"WMER","description":"Windermere","workingTime":"183000","publicTime":"1830"}],"destination":[{"tiploc":"MNCRPIC","description":"Manchester Piccadilly","workingTime":"204500","publicTime":"2045"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2007","realtimeArrivalActual":false,"realtimeDeparture":"2008","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y53223","runDate":"2019-02-11","trainIdentity":"2K54","runningIdentity":"2K54","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2043","gbttBookedDeparture":"2044","origin":[{"tiploc":"MNCRVIC","description":"Manchester Victoria","workingTime":"200500","publicTime":"2005"}],"destination":[{"tiploc":"PRST","description":"Preston","workingTime":"211100","publicTime":"2113"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2043","realtimeArrivalActual":false,"realtimeDeparture":"2044","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y54186","runDate":"2019-02-11","trainIdentity":"2P44","runningIdentity":"2P44","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2103","gbttBookedDeparture":"2104","origin":[{"tiploc":"BLCKPLN","description":"Blackpool North","workingTime":"201400","publicTime":"2014"}],"destination":[{"tiploc":"MNCRPIC","description":"Manchester Piccadilly","workingTime":"214300","publicTime":"2143"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2103","realtimeArrivalActual":false,"realtimeDeparture":"2104","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y53227","runDate":"2019-02-11","trainIdentity":"2K55","runningIdentity":"2K55","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2127","gbttBookedDeparture":"2127","origin":[{"tiploc":"PRST","description":"Preston","workingTime":"210800","publicTime":"2108"}],"destination":[{"tiploc":"MNCROXR","description":"Manchester Oxford Road","workingTime":"220400","publicTime":"2204"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2126","realtimeArrivalActual":false,"realtimeDeparture":"2127","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y50887","runDate":"2019-02-11","trainIdentity":"1Y68","runningIdentity":"1Y68","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true}&lt;/P&gt;</description>
    <pubDate>Mon, 11 Feb 2019 20:45:00 GMT</pubDate>
    <dc:creator>stevenbutterwor</dc:creator>
    <dc:date>2019-02-11T20:45:00Z</dc:date>
    <item>
      <title>How do you remove a header from JSON?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378983#M68518</link>
      <description>&lt;P&gt;Hi all&lt;/P&gt;

&lt;P&gt;I'm ingesting some JSON via REST API, but the events are all squashed into one large event.  I'm pretty sure it's because there is a header at the top of the file that needs to be removed for the JSON to be parsed correctly.&lt;/P&gt;

&lt;P&gt;I think, again, I need to add SEDCMD to the props, but I'm unsure of the regex required.   Any help would be appreciated — below is a sample of the JSON.  The bold section is the header.&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;{"location":{"name":"Adlington (Lancashire)","crs":"ADL","tiploc":"ADNL"},"filter":null,"services":&lt;/STRONG&gt;[{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2006","gbttBookedDeparture":"2006","origin":[{"tiploc":"BLCKPLN","description":"Blackpool North","workingTime":"191600","publicTime":"1916"},{"tiploc":"WMER","description":"Windermere","workingTime":"183000","publicTime":"1830"}],"destination":[{"tiploc":"MNCRPIC","description":"Manchester Piccadilly","workingTime":"204500","publicTime":"2045"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2007","realtimeArrivalActual":false,"realtimeDeparture":"2008","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y53223","runDate":"2019-02-11","trainIdentity":"2K54","runningIdentity":"2K54","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2043","gbttBookedDeparture":"2044","origin":[{"tiploc":"MNCRVIC","description":"Manchester Victoria","workingTime":"200500","publicTime":"2005"}],"destination":[{"tiploc":"PRST","description":"Preston","workingTime":"211100","publicTime":"2113"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2043","realtimeArrivalActual":false,"realtimeDeparture":"2044","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y54186","runDate":"2019-02-11","trainIdentity":"2P44","runningIdentity":"2P44","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2103","gbttBookedDeparture":"2104","origin":[{"tiploc":"BLCKPLN","description":"Blackpool North","workingTime":"201400","publicTime":"2014"}],"destination":[{"tiploc":"MNCRPIC","description":"Manchester Piccadilly","workingTime":"214300","publicTime":"2143"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2103","realtimeArrivalActual":false,"realtimeDeparture":"2104","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y53227","runDate":"2019-02-11","trainIdentity":"2K55","runningIdentity":"2K55","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true},{"locationDetail":{"realtimeActivated":true,"tiploc":"ADNL","crs":"ADL","description":"Adlington (Lancashire)","gbttBookedArrival":"2127","gbttBookedDeparture":"2127","origin":[{"tiploc":"PRST","description":"Preston","workingTime":"210800","publicTime":"2108"}],"destination":[{"tiploc":"MNCROXR","description":"Manchester Oxford Road","workingTime":"220400","publicTime":"2204"}],"isCall":true,"isPublicCall":true,"realtimeArrival":"2126","realtimeArrivalActual":false,"realtimeDeparture":"2127","realtimeDepartureActual":false,"displayAs":"CALL"},"serviceUid":"Y50887","runDate":"2019-02-11","trainIdentity":"1Y68","runningIdentity":"1Y68","atocCode":"NT","atocName":"Northern","serviceType":"train","isPassenger":true}&lt;/P&gt;</description>
      <pubDate>Mon, 11 Feb 2019 20:45:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378983#M68518</guid>
      <dc:creator>stevenbutterwor</dc:creator>
      <dc:date>2019-02-11T20:45:00Z</dc:date>
    </item>
    <item>
      <title>Re: How do you remove a header from JSON?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378984#M68519</link>
      <description>&lt;P&gt;If you are using the "REST Modular Input" you might be able to set "Response Handler" to be "JSONArrayHandler" and it should split it into individual events properly. &lt;/P&gt;

&lt;P&gt;If that doesn't work, then i think you should set LINE_BREAKER to split correctly by events:&lt;/P&gt;

&lt;P&gt;&lt;CODE&gt;LINE_BREAKER = (^[^\[]+\[|,){"locationDetail"&lt;/CODE&gt;&lt;/P&gt;

&lt;P&gt;This will discard the header as well as split events correctly. &lt;/P&gt;

&lt;P&gt;Good luck!&lt;/P&gt;</description>
      <pubDate>Mon, 11 Feb 2019 21:16:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378984#M68519</guid>
      <dc:creator>chrisyounger</dc:creator>
      <dc:date>2019-02-11T21:16:36Z</dc:date>
    </item>
    <item>
      <title>Re: How do you remove a header from JSON?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378985#M68520</link>
      <description>&lt;P&gt;Hello, thanks for the advice but none of it worked &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Any ideas about removing that line that's not needed as it's still being indexed.&lt;/P&gt;

&lt;P&gt;Thanks!&lt;/P&gt;</description>
      <pubDate>Tue, 12 Feb 2019 12:25:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378985#M68520</guid>
      <dc:creator>stevenbutterwor</dc:creator>
      <dc:date>2019-02-12T12:25:22Z</dc:date>
    </item>
    <item>
      <title>Re: How do you remove a header from JSON?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378986#M68521</link>
      <description>&lt;P&gt;Here is the props&lt;/P&gt;

&lt;P&gt;[realtimetrains:basic]&lt;BR /&gt;
DATETIME_CONFIG = CURRENT&lt;BR /&gt;
INDEXED_EXTRACTIONS = json&lt;BR /&gt;
LINE_BREAKER = (^[^[]+[|,){"locationDetail"&lt;BR /&gt;
NO_BINARY_CHECK = true&lt;BR /&gt;
category = Custom&lt;BR /&gt;
pulldown_type = 1&lt;BR /&gt;
disabled = false&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 23:12:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/378986#M68521</guid>
      <dc:creator>stevenbutterwor</dc:creator>
      <dc:date>2020-09-29T23:12:56Z</dc:date>
    </item>
    <item>
      <title>Re: How do you remove a header from JSON?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/578308#M102116</link>
      <description>&lt;P&gt;did you find the solution&lt;/P&gt;</description>
      <pubDate>Tue, 14 Dec 2021 11:53:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-do-you-remove-a-header-from-JSON/m-p/578308#M102116</guid>
      <dc:creator>rashid47010</dc:creator>
      <dc:date>2021-12-14T11:53:40Z</dc:date>
    </item>
  </channel>
</rss>

