topic Need help on breaking my json data to several events in Getting Data In

Need help on breaking my json data to several events

robertbumanglag — Wed, 23 Dec 2020 10:37:18 GMT

I'm really stucked right now on my configuration for my json data below.

I'm currently building a data collector app in Splunk Add-on Builder. Here's the current configuration

My goal is to break the Integration_Business_Process_Events_group sub values into another event but should retain parent event details. So instead of having 1 event, I should have 6 events.

Hope for your answers. I already look into to the other similar problem like this by I'm getting more confuse.

Thanks everyone!

Re: Need help on breaking my json data to several events

to4kawa — Tue, 29 Dec 2020 02:41:23 GMT

props.conf can't extract what you want.

try following:

index=your_index sourcetype=your_sourcetype | spath Integration_Business_Process_Events_group{} output=IBPEg | mvexpand IBPEg | spath | spath input=IBPEg | fields - Integration_Business_Process_Events_group* IBPEg _raw | table *

Re: Need help on breaking my json data to several events

robertbumanglag — Tue, 05 Jan 2021 09:15:02 GMT

Hi! Thanks, this helped.