topic Breaking events JSON in Getting Data In

Breaking events JSON

mmoermans — Wed, 30 Sep 2020 01:24:39 GMT

For some reason the LINE_BREAKER option for Splunk keeps turning a JSON log file into a single event, ignoring everything after the first event. Does anyone have any experience with breaking the events up for the following log?:

{"aModLR":{"attributes":{"affected":"topology/pod/node/av/node","cause":"transition","changeSet":"targetMn (Old: AAA, New: BBB)","childAction":"","clientTag":"","code":"E69","created":"2019-07-18T16:38:41.501+02:00","descr":"Node modified","dn":"subj-[topology/pod/node/av/node]/mod-43243","id":"23432","ind":"modification","modTs":"never","sessionId":"ABCD",severity":"info","status":"","trig":"config","txId":"18374686479671625257","user":"admin"}}},{"aModLR":{"attributes":{"affected":"pluginPolContr/pluginPol","cause":"transition","changeSet":"verifySignature:enable","childAction":"","clientTag":"","code":"E68","created":"2019-07-18T10:31:11.748+02:00","descr":"PluginPol created","dn":"subj-[pluginPolContr/pluginPol]/mod-1234","id":"12345","ind":"creation","modTs":"never","sessionId":"ABCDEF123",severity":"info","status":"","trig":"config","txId":"5645","user":"admin2"}}}

I've tried BREAK_ONLY_BEFORE = {"aModLR" or LINE_BREAKER = {"aModLR() but it still turns it into a single event.

Re: Breaking events JSON

to4kawa — Thu, 26 Dec 2019 02:02:34 GMT

LINE_BREAKER = \{\"aModLR\"

I think you need to escape the string.

| makeresults 
| eval _raw="{\"aModLR\":{\"attributes\":{\"affected\":\"topology/pod/node/av/node\",\"cause\":\"transition\",\"changeSet\":\"targetMn (Old: AAA, New: BBB)\",\"childAction\":\"\",\"clientTag\":\"\",\"code\":\"E69\",\"created\":\"2019-07-18T16:38:41.501+02:00\",\"descr\":\"Node modified\",\"dn\":\"subj-[topology/pod/node/av/node]/mod-43243\",\"id\":\"23432\",\"ind\":\"modification\",\"modTs\":\"never\",\"sessionId\":\"ABCD\",\"severity\":\"info\",\"status\":\"\",\"trig\":\"config\",\"txId\":\"18374686479671625257\",\"user\":\"admin\"}}}"
| appendpipe 
    [eval _raw="{\"aModLR\":{\"attributes\":{\"affected\":\"pluginPolContr/pluginPol\",\"cause\":\"transition\",\"changeSet\":\"verifySignature:enable\",\"childAction\":\"\",\"clientTag\":\"\",\"code\":\"E68\",\"created\":\"2019-07-18T10:31:11.748+02:00\",\"descr\":\"PluginPol created\",\"dn\":\"subj-[pluginPolContr/pluginPol]/mod-1234\",\"id\":\"12345\",\"ind\":\"creation\",\"modTs\":\"never\",\"sessionId\":\"ABCDEF123\",\"severity\":\"info\",\"status\":\"\",\"trig\":\"config\",\"txId\":\"5645\",\"user\":\"admin2\"}}}"]
| rex mode=sed "s/({|\\\",)/\1\n/g"
| spath

I tried extracting fields with a query as an example.