topic Re: linebreaker for json sourcetype in Getting Data In

linebreaker for json sourcetype

martinnepolean — Wed, 30 Sep 2020 03:39:24 GMT

I am trying to break the below json data into each event

{"audit_logs": [{"url": "https://Company.udesk.com/api/v2/audit_logs/3650750.json", "id": 3650750, "actor_id": 27401, "source_id": 36012509503, "source_type": "view", "source_label": "View: Copy of ALL CX BC", "action": "create", "change_description": "", "ip_address": "116.10.16.1", "created_at": "2019-12-13T06:04:32Z", "user": "VASU JOGI"}, {"url": "https://Company.udesk.com/api/v2/audit_logs/365073140614.json", "id": 365073140614, "actor_id": 28319638, "source_id": 3600001411, "source_type": "account_setting", "source_label": "Account Assumption", "action": "update", "change_description": "Changed", "ip_address": "160.12.15.26", "created_at": "2019-12-12T22:18:14Z", "user": "Sejal Jack"}]}

from the above log event 1 should be as below and rest of the message should be another event.
{"url": "https://Company.udesk.com/api/v2/audit_logs/3650750.json", "id": 3650750, "actor_id": 27401, "source_id": 36012509503, "source_type": "view", "source_label": "View: Copy of ALL CX BC", "action": "create", "change_description": "", "ip_address": "116.10.16.1", "created_at": "2019-12-13T06:04:32Z", "user": "VASU JOGI"},

Below is my Props.conf which is deployed on UF. Please help to get it working

[_json]
LINE_BREAKER = (,*\s+){"url"
SHOULD_LINEMERGE = false

Re: linebreaker for json sourcetype

calcometer — Wed, 30 Sep 2020 03:39:27 GMT

Use the path command mit curl braces.

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Spath

|spath input=_raw output=events path=audit_logs{}

Re: linebreaker for json sourcetype

martinnepolean — Tue, 14 Jan 2020 15:47:36 GMT

No it is not working? is it possible to do it via props file?

Re: linebreaker for json sourcetype

calcometer — Wed, 15 Jan 2020 09:29:48 GMT

The input of _raw need to be the blank JSON String

Re: linebreaker for json sourcetype

martinnepolean — Wed, 15 Jan 2020 12:40:56 GMT

yes i tried, but no luck? is it not possible to do the parsing via props.conf .I am looking for search time field extraction.

Re: linebreaker for json sourcetype

to4kawa — Sun, 01 Mar 2020 02:37:56 GMT

props.conf

[audit_json]
SEDCMD-trim = s/^.*\[(.*)\]}/\1/g
LINE_BREAKER = }(,)
KV_MODE = json
SHOULD_LINEMERGE = false

Re: linebreaker for json sourcetype

sumanssah — Sun, 01 Mar 2020 03:50:40 GMT

try using below-mentioned search for your json index

search
   | rex "(?<json>\{.+)" | spath input=json | fields - json