https://community.splunk.com/t5/Getting-Data-In/Line-Breaker-for-sample-Json/m-p/477140#M81909 <P>Here is the JSON Sample. Please help<BR /> {"alertConfigId":"fggc040c38ea6097a557239","created":"2019-10-22T08:39:45Z","currentValue":{"number":1.29420086E8,"units":"BYTES"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"e79903b6775f5481d0bf5c00e9053d66","hostnameAndPort":"xx.xx.x:27017","id":"5daec051c38ea6097a557268","lastNotified":"2019-10-28T12:12:22Z","links":[{"href":"<A href="http://xx.xx.xx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a557268%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CACHE_USAGE_USED%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22%7D,%7B%22alertConfigId%22:%225daec040c38ea6097a557239%22,%22created%22:%222019-10-22T08:39:45Z%22,%22currentValue%22:%7B%22number%22:49565.0,%22units%22:%22BYTES%22%7D,%22eventTypeName%22:%22OUTSIDE_METRIC_THRESHOLD%22,%22groupId%22:%225da99671c38ea60754b28014%22,%22hostId%22:%226451480dc35feb8fe62d6fdd02136241%22,%22hostnameAndPort%22:%22ip-1xx.xx.x.ec2.internal:27017%22,%22id%22:%225daec051c38ea6097a55726a%22,%22lastNotified%22:%222019-10-28T12:12:22Z%22,%22links%22:%5B%7B%22href%22:%22http://xxxx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a55726a%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CACHE_USAGE_USED%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22%7D,%7B%22alertConfigId%22:%225daec33ec38ea6097a557927%22,%22created%22:%222019-10-22T08:52:45Z%22,%22currentValue%22:%7B%22number%22:35.0,%22units%22:%22RAW%22%7D,%22eventTypeName%22:%22OUTSIDE_METRIC_THRESHOLD%22,%22groupId%22:%225da99671c38ea60754b28014%22,%22hostId%22:%22e79903b6775f5481d0bf5c00e9053d66%22,%22hostnameAndPort%22:%22xxxx:27017%22,%22id%22:%225daec35dc38ea6097a557986%22,%22lastNotified%22:%222019-10-28T12:01:22Z%22,%22links%22:%5B%7B%22href%22:%22http://xx.xx.x:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec35dc38ea6097a557986%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CONNECTIONS%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22" target="_blank">http://xx.xx.xx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a557268","rel":"self"}],"metricName":"CACHE_USAGE_USED","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"},{"alertConfigId":"5daec040c38ea6097a557239","created":"2019-10-22T08:39:45Z","currentValue":{"number":49565.0,"units":"BYTES"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"6451480dc35feb8fe62d6fdd02136241","hostnameAndPort":"ip-1xx.xx.x.ec2.internal:27017","id":"5daec051c38ea6097a55726a","lastNotified":"2019-10-28T12:12:22Z","links":[{"href":"http://xxxx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a55726a","rel":"self"}],"metricName":"CACHE_USAGE_USED","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"},{"alertConfigId":"5daec33ec38ea6097a557927","created":"2019-10-22T08:52:45Z","currentValue":{"number":35.0,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"e79903b6775f5481d0bf5c00e9053d66","hostnameAndPort":"xxxx:27017","id":"5daec35dc38ea6097a557986","lastNotified":"2019-10-28T12:01:22Z","links":[{"href":"http://xx.xx.x:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec35dc38ea6097a557986","rel":"self"}],"metricName":"CONNECTIONS","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"</A>}</P> <P>Here is my props.conf<BR /> [custom]<BR /> BREAK_ONLY_BEFORE = {\"alertConfigId\"<BR /> SHOULD_LINEMERGE=true<BR /> KV_MODE=json</P> Wed, 30 Sep 2020 02:50:50 GMT sriramakrishna_ 2020-09-30T02:50:50Z https://community.splunk.com/t5/Getting-Data-In/Line-Breaker-for-sample-Json/m-p/477140#M81909 <P>Here is the JSON Sample. Please help<BR /> {"alertConfigId":"fggc040c38ea6097a557239","created":"2019-10-22T08:39:45Z","currentValue":{"number":1.29420086E8,"units":"BYTES"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"e79903b6775f5481d0bf5c00e9053d66","hostnameAndPort":"xx.xx.x:27017","id":"5daec051c38ea6097a557268","lastNotified":"2019-10-28T12:12:22Z","links":[{"href":"<A href="http://xx.xx.xx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a557268%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CACHE_USAGE_USED%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22%7D,%7B%22alertConfigId%22:%225daec040c38ea6097a557239%22,%22created%22:%222019-10-22T08:39:45Z%22,%22currentValue%22:%7B%22number%22:49565.0,%22units%22:%22BYTES%22%7D,%22eventTypeName%22:%22OUTSIDE_METRIC_THRESHOLD%22,%22groupId%22:%225da99671c38ea60754b28014%22,%22hostId%22:%226451480dc35feb8fe62d6fdd02136241%22,%22hostnameAndPort%22:%22ip-1xx.xx.x.ec2.internal:27017%22,%22id%22:%225daec051c38ea6097a55726a%22,%22lastNotified%22:%222019-10-28T12:12:22Z%22,%22links%22:%5B%7B%22href%22:%22http://xxxx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a55726a%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CACHE_USAGE_USED%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22%7D,%7B%22alertConfigId%22:%225daec33ec38ea6097a557927%22,%22created%22:%222019-10-22T08:52:45Z%22,%22currentValue%22:%7B%22number%22:35.0,%22units%22:%22RAW%22%7D,%22eventTypeName%22:%22OUTSIDE_METRIC_THRESHOLD%22,%22groupId%22:%225da99671c38ea60754b28014%22,%22hostId%22:%22e79903b6775f5481d0bf5c00e9053d66%22,%22hostnameAndPort%22:%22xxxx:27017%22,%22id%22:%225daec35dc38ea6097a557986%22,%22lastNotified%22:%222019-10-28T12:01:22Z%22,%22links%22:%5B%7B%22href%22:%22http://xx.xx.x:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec35dc38ea6097a557986%22,%22rel%22:%22self%22%7D%5D,%22metricName%22:%22CONNECTIONS%22,%22status%22:%22OPEN%22,%22typeName%22:%22HOST_METRIC%22,%22updated%22:%222019-10-28T13:33:14Z%22" target="_blank">http://xx.xx.xx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a557268","rel":"self"}],"metricName":"CACHE_USAGE_USED","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"},{"alertConfigId":"5daec040c38ea6097a557239","created":"2019-10-22T08:39:45Z","currentValue":{"number":49565.0,"units":"BYTES"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"6451480dc35feb8fe62d6fdd02136241","hostnameAndPort":"ip-1xx.xx.x.ec2.internal:27017","id":"5daec051c38ea6097a55726a","lastNotified":"2019-10-28T12:12:22Z","links":[{"href":"http://xxxx:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec051c38ea6097a55726a","rel":"self"}],"metricName":"CACHE_USAGE_USED","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"},{"alertConfigId":"5daec33ec38ea6097a557927","created":"2019-10-22T08:52:45Z","currentValue":{"number":35.0,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5da99671c38ea60754b28014","hostId":"e79903b6775f5481d0bf5c00e9053d66","hostnameAndPort":"xxxx:27017","id":"5daec35dc38ea6097a557986","lastNotified":"2019-10-28T12:01:22Z","links":[{"href":"http://xx.xx.x:8080/api/public/v1.0/groups/5da99671c38ea60754b28014/alerts/5daec35dc38ea6097a557986","rel":"self"}],"metricName":"CONNECTIONS","status":"OPEN","typeName":"HOST_METRIC","updated":"2019-10-28T13:33:14Z"</A>}</P> <P>Here is my props.conf<BR /> [custom]<BR /> BREAK_ONLY_BEFORE = {\"alertConfigId\"<BR /> SHOULD_LINEMERGE=true<BR /> KV_MODE=json</P> Wed, 30 Sep 2020 02:50:50 GMT https://community.splunk.com/t5/Getting-Data-In/Line-Breaker-for-sample-Json/m-p/477140#M81909 sriramakrishna_ 2020-09-30T02:50:50Z https://community.splunk.com/t5/Getting-Data-In/Line-Breaker-for-sample-Json/m-p/477141#M81910 <P>Use these settings:</P> <PRE><CODE>[custom] SHOULD_LINEMERGE=false LINE_BREAKER=(,){"alertConfigId KV_MODE=json </CODE></PRE> Thu, 07 Nov 2019 19:53:21 GMT https://community.splunk.com/t5/Getting-Data-In/Line-Breaker-for-sample-Json/m-p/477141#M81910 mayurr98 2019-11-07T19:53:21Z