Why do I have several JSON events showing as a single Splunk event?

moorvogi — Tue, 30 Oct 2018 19:17:49 GMT

I have 1-40 (or more) JSON objects that are seen as one event within Splunk. Each JSON object ends w/ the "}" character and is a valid JSON object. For whatever reason, there are just several JSON objects per one Splunk event.

How do i split this so it's one JSON entry per Splunk event?

Re: Why do I have several JSON events showing as a single Splunk event?

pruthvikrishnap — Tue, 29 Sep 2020 21:50:39 GMT

Hi ,
There are multiple ways you can split the JSON events, you can try adding sedcmd to props.conf somnething like this.
[myJSON]
SEDCMD-remove_header = s/^(?:.\n){1,3}//g
SEDCMD-remove_footer = s/][\r\n]\s}.$//g
LINE_BREAKER = }(\s,[\r\n]\s*){`

else you can update a responsehandler which is a python class and use it in your inputs.
https://answers.splunk.com/answers/233620/how-to-use-custom-response-handlers-for-monitoring-1.html

i am not sure on what your scenario is

topic Why do I have several JSON events showing as a single Splunk event? in Getting Data In

Why do I have several JSON events showing as a single Splunk event?

Re: Why do I have several JSON events showing as a single Splunk event?