Issue with parsing Json data

slipinski — Mon, 30 Nov 2020 21:46:00 GMT

Hello Splunkers,

I'm facing problem with correct parsing json data. Splunk correctly recognizes data as json sourced, but with default settings, it cannot parse data correctly. It creates fields like: 3b629fbf-be6c-4806-8ceb-1e2b196b6277.currentUtilisation or device31.1.127.out::device54.1.87.in.currentUtilisation. As the main field is irregular I don't know how to set line_breaker which is the most likely main cause of the problem. Can I count on your help?
A chunk of the input file is below.

{ "device31.1.127.out::device54.1.87.in": { "currentUtilisation": 0.0, "enabled": true, "from": "device31.1.127.out", "hasBookings": false, "id": "device31.1.127.out::device54.1.87.in", "isActive": false, "name": "Adam", "props": { "bandwidth": 90000.0, "conflictPri": 1, "description": "" }, "to": "device54.1.87.in", "usage": { "bookings": [], "id": "device31.1.127.out::device54.1.87.in" } }, "device49.1.117.out::device34.1.69.in": { "currentUtilisation": 0.0, "enabled": true, "from": "device49.1.117.out", "hasBookings": false, "id": "device49.1.117.out::device34.1.69.in", "isActive": false, "name": "Barek", "props": { "bandwidth": 90000.0, "conflictPri": 1, "description": "" }, "to": "device34.1.69.in", "usage": { "bookings": [], "id": "device49.1.117.out::device34.1.69.in" } }, "3b629fbf-be6c-4806-8ceb-1e2b196b6277": { "currentUtilisation": 0.0, "enabled": true, "from": "device38.1.93.out", "hasBookings": false, "id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277", "isActive": false, "name": "Cezary", "props": { "bandwidth": 90000.0, "conflictPri": 1, "description": "" }, "to": "device441.1.89.in", "usage": { "bookings": [], "id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277" } }, "87725874-f760-4e37-9421-168506a05573": { "currentUtilisation": 0.0, "enabled": true, "from": "device21.1.75.out", "hasBookings": false, "id": "87725874-f760-4e37-9421-168506a05573", "isActive": false, "name": "Darek", "props": { "bandwidth": 90000.0, "conflictPri": 1, "description": "" }, "to": "device61.1.97.in", "usage": { "bookings": [], "id": "87725874-f760-4e37-9421-168506a05573" } } }

Re: Issue with parsing Json data

inventsekar — Mon, 30 Nov 2020 23:54:33 GMT

Hi @slipinski would you like index-time or search-time parsing? may i know if you are aware of the command "spath", please suggest, thanks.

Best Regards,

Sekar

Re: Issue with parsing Json data

slipinski — Tue, 01 Dec 2020 07:12:49 GMT

I would rather use index-time parsing. Honestly speaking I'm not very familiar with "spath" command. Could it help with parsing, even though line _breaker isn't correct?

topic Re: Issue with parsing Json data in Getting Data In

Issue with parsing Json data

Re: Issue with parsing Json data

Re: Issue with parsing Json data