topic Re: Remove { } from json file before indexing in Getting Data In

Remove { } from json file before indexing

abilis — Fri, 18 May 2018 02:35:13 GMT

HI,

i am trying to index a local json file, but when going trough the sourcetype the predefined json source type is not reading the file properly..splunk put everything in one line...no detecting time format or something (see attached file)

then i found that splunk is not indexing separate events because the json file starts with { and ends with } if i removed those character splunk will give me a line per event.

does someone knows how I can remove the { at the beginning and the } at the end with splunk before indexing?

i'm putting this when i go through wizard data inpout local file in the advance section

SEDCMD-removesymbol = s/^{/g (this is not working)

thanks
{
"records":
[

     {
         "time": "2018-05-11T13:29:03Z",        
          "GatewayId": "4r566-5678-4753-968f-34568",
          "Region": "unknown",
           "operationName": "ApplicationGatewayAccess",
           "category": "ApplicationGatewayAccessLog",
         }
     ,

{
"time": "2018-05-11T13:29:05Z",

"GatewayId": "4r566-ae57-dfg543-968f-xxx45t67",
"Region": "unknown",
"operationName": "ApplicationGatewayAccess",
"category": "ApplicationGatewayAccessLog",
}
}

can someone please help me ?

thanks

Re: Remove { } from json file before indexing

xpac — Fri, 18 May 2018 07:20:05 GMT

Hey,

you're only missing a single char: s/^{//g 😉

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Re: Remove { } from json file before indexing

abilis — Fri, 18 May 2018 16:53:59 GMT

I've being working in this issue for two days and still don't undestand what the SEDCMD-class = s/^{//g is NOT removing the starting" { " during the data preview. if i dont remove the starting " { " from the .json file i'm trying to index, splunk will put all the events in 1 line

i have tried many combinations but still not working..data preview always show all event in one line,
SEDCMD-class =s/^{//g
SEDCMD-class =s/^{//
SEDCMD-class =s/{//g
SEDCMD-class =s/{/

when removing manually the starting " { ", splunk is able to display 1 event per record in the .json file...all my .json files start with " { " and this is how Microsoft format it...don't know why

can someone help me to figure this out ???

{
"records":
[

          {
              "time": "2018-05-11T13:29:03Z",        
               "GatewayId": "4r566-5678-4753-968f-34568",
               "Region": "unknown",
                "operationName": "ApplicationGatewayAccess",
                "category": "ApplicationGatewayAccessLog",
              }
          ,

{
"time": "2018-05-11T13:29:05Z",
"GatewayId": "4r566-ae57-dfg543-968f-xxx45t67",
"Region": "unknown",
"operationName": "ApplicationGatewayAccess",
"category": "ApplicationGatewayAccessLog",
}
}