topic Multiple json events coming as one in Getting Data In

Multiple json events coming as one

khalid7assan — Thu, 16 Apr 2020 12:36:42 GMT

I have multiple events which are coming as one
and I need to separate them into separate events in order to create a table and etc
Is there a way to do it in the search time?
{
"Timestamp": "2020-02-08T15:45:00.036Z",
"Query Parameters": "",
"RequestMethod": "POST",
"Request": "{tt}",
"Response": "{tt}",
"HTTPStatusCode": "200",
"TotalResponseTimeApprox.(ms)": "290.0",
"TargetResponseTime(ms)": "241.0"
}{
"Timestamp": "2020-02-08T15:45:00.334Z",
"Query Parameters": "",
"RequestMethod": "POST",
"Request": "{tt}",
"Response": "{tt}",
"HTTPStatusCode": "200",
"TotalResponseTimeApprox.(ms)": "290.0",
"TargetResponseTime(ms)": "241.0"
}

Thank you

Re: Multiple json events coming as one

javiergn — Thu, 16 Apr 2020 14:24:19 GMT

Hi @khalid7assan,

Your event can be parsed with the following SPL:

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw

You can replicate the behaviour by copying and pasting the following code in Splunk:

| makeresults
| eval _raw = "
    {
    \"Timestamp\": \"2020-02-08T15:45:00.036Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }{
    \"Timestamp\": \"2020-02-08T15:45:00.334Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }
"

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw
| fields - _raw, _time

Output:

If you find any issues or your events are more complex than the one you included in your question, please post some more examples so that we can take a look.

Regards,
J

Re: Multiple json events coming as one

to4kawa — Thu, 16 Apr 2020 21:14:03 GMT

props.conf

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER =(^){

make appropriate props.conf

Re: Multiple json events coming as one

javiergn — Sun, 19 Apr 2020 16:49:57 GMT

Hi @khalid7assan,

Did any of the answers below help with your problem? If so please don't forget to accept one so that other users can benefit from this answer in the future.

Thanks,
J

Re: Multiple json events coming as one

khalid7assan — Mon, 20 Apr 2020 07:31:44 GMT

Thank you it worked