https://community.splunk.com/t5/Getting-Data-In/Rest-api-amp-splitting-json-events-with-fields-and-timestamps/m-p/545599#M90948 <P>Hi, im really struggling to split out events from my json at the moment.</P><P>currently i only get a single event with multi values in or multiple events but no field names</P><P>here is an example response from a request with the props.conf setup.</P><P>&nbsp;</P><LI-CODE lang="markup">[ CMMS_ECP_TASKS_JSON1 ] BREAK_ONLY_BEFORE=(\{|\[\s+{) BREAK_ONLY_BEFORE_DATE=false CHARSET=AUTO LINE_BREAKER=(\}|\[\s+{) MAX_DAYS_HENCE=180 MAX_TIMESTAMP_LOOKAHEAD=180 MUST_BREAK_AFTER=(\}|\}\s+\]) NO_BINARY_CHECK=true SEDCMD-remove_footer=s/\]\s+\}//g SEDCMD-remove_header=s/(\{(\s+.*){3}\[)//g SEDCMD-remove_trailing_commas=s/\},/}/g SHOULD_LINEMERGE=true TIME_FORMAT=%Y-%m-%dT%H:%M:%S%%% TIME_PREFIX=\"dateFrom\"\: category=Custom disabled=false pulldown_type=true description=test json</LI-CODE><LI-CODE lang="markup">{"id":16,"dateFrom":"2021-03-03T00:00:00+01:00","priority":3},{"id":29,"dateFrom":"2021-01-28T00:00:00+01:00","priority":3},{"id":183,"dateFrom":"2021-01-19T00:00:00+01:00","priority":2},{"id":184,"dateFrom":"2021-01-19T00:00:00+01:00","priority":2},{"id":197,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":216,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":217,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":218,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":219,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":220,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":221,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":222,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":223,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":224,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":225,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":226,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":227,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":228,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":229,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":230,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":231,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":232,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":233,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":234,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":235,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":236,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":237,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":238,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":239,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":240,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":241,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":242,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":243,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":244,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":245,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":246,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":247,"dateFrom":"2021-05-03T00:00:00+02:00","priority":2},{"id":248,"dateFrom":"2021-05-03T00:00:00+02:00","priority":2},{"id":249,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":250,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":251,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":252,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":253,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":254,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":255,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":256,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":257,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":258,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":259,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":260,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":261,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":262,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":263,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":264,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":265,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":266,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":267,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":268,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":269,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":270,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":271,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":272,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":310,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":311,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":312,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":313,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":314,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":315,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":316,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":317,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":318,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":319,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":320,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":321,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":322,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":323,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":324,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":325,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":326,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":327,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":328,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":329,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":330,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":331,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":332,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":333,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":334,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":335,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":336,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":337,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":338,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":339,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":340,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":341,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":342,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":343,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":344,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":345,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":346,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":347,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":348,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":349,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":350,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":351,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2}</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 26 Mar 2021 13:56:19 GMT luminousplumz 2021-03-26T13:56:19Z https://community.splunk.com/t5/Getting-Data-In/Rest-api-amp-splitting-json-events-with-fields-and-timestamps/m-p/545599#M90948 <P>Hi, im really struggling to split out events from my json at the moment.</P><P>currently i only get a single event with multi values in or multiple events but no field names</P><P>here is an example response from a request with the props.conf setup.</P><P>&nbsp;</P><LI-CODE lang="markup">[ CMMS_ECP_TASKS_JSON1 ] BREAK_ONLY_BEFORE=(\{|\[\s+{) BREAK_ONLY_BEFORE_DATE=false CHARSET=AUTO LINE_BREAKER=(\}|\[\s+{) MAX_DAYS_HENCE=180 MAX_TIMESTAMP_LOOKAHEAD=180 MUST_BREAK_AFTER=(\}|\}\s+\]) NO_BINARY_CHECK=true SEDCMD-remove_footer=s/\]\s+\}//g SEDCMD-remove_header=s/(\{(\s+.*){3}\[)//g SEDCMD-remove_trailing_commas=s/\},/}/g SHOULD_LINEMERGE=true TIME_FORMAT=%Y-%m-%dT%H:%M:%S%%% TIME_PREFIX=\"dateFrom\"\: category=Custom disabled=false pulldown_type=true description=test json</LI-CODE><LI-CODE lang="markup">{"id":16,"dateFrom":"2021-03-03T00:00:00+01:00","priority":3},{"id":29,"dateFrom":"2021-01-28T00:00:00+01:00","priority":3},{"id":183,"dateFrom":"2021-01-19T00:00:00+01:00","priority":2},{"id":184,"dateFrom":"2021-01-19T00:00:00+01:00","priority":2},{"id":197,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":216,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":217,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":218,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":219,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":220,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":221,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":222,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":223,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":224,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":225,"dateFrom":"2021-03-22T00:00:00+01:00","priority":2},{"id":226,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":227,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":228,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":229,"dateFrom":"2021-04-05T00:00:00+02:00","priority":2},{"id":230,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":231,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":232,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":233,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":234,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":235,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":236,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":237,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":238,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":239,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":240,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":241,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":242,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":243,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":244,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":245,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":246,"dateFrom":"2021-04-19T00:00:00+02:00","priority":2},{"id":247,"dateFrom":"2021-05-03T00:00:00+02:00","priority":2},{"id":248,"dateFrom":"2021-05-03T00:00:00+02:00","priority":2},{"id":249,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":250,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":251,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":252,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":253,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":254,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":255,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":256,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":257,"dateFrom":"2021-05-17T00:00:00+02:00","priority":2},{"id":258,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":259,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":260,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":261,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":262,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":263,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":264,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":265,"dateFrom":"2021-05-31T00:00:00+02:00","priority":2},{"id":266,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":267,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":268,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":269,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":270,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":271,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":272,"dateFrom":"2021-06-14T00:00:00+02:00","priority":2},{"id":310,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":311,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":312,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":313,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":314,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":315,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":316,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":317,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":318,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":319,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":320,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":321,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":322,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":323,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":324,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":325,"dateFrom":"2021-06-28T00:00:00+02:00","priority":2},{"id":326,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":327,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":328,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":329,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":330,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":331,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":332,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":333,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":334,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":335,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":336,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":337,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":338,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":339,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":340,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":341,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":342,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":343,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":344,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":345,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":346,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":347,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":348,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":349,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":350,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2},{"id":351,"dateFrom":"1753-01-01T00:00:00+01:00","priority":2}</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Fri, 26 Mar 2021 13:56:19 GMT https://community.splunk.com/t5/Getting-Data-In/Rest-api-amp-splitting-json-events-with-fields-and-timestamps/m-p/545599#M90948 luminousplumz 2021-03-26T13:56:19Z https://community.splunk.com/t5/Getting-Data-In/Rest-api-amp-splitting-json-events-with-fields-and-timestamps/m-p/545642#M90950 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/183155">@luminousplumz</a>,</P><P>Please try using below props;</P><LI-CODE lang="markup">[CMMS_ECP_TASKS_JSON1] SHOULD_LINEMERGE=false LINE_BREAKER=\}(,)|\}() NO_BINARY_CHECK=true TIME_FORMAT=%Y-%m-%dT%H:%M:%S%%% TIME_PREFIX=\"dateFrom\":\" CHARSET=AUTO</LI-CODE> Fri, 26 Mar 2021 18:30:13 GMT https://community.splunk.com/t5/Getting-Data-In/Rest-api-amp-splitting-json-events-with-fields-and-timestamps/m-p/545642#M90950 scelikok 2021-03-26T18:30:13Z