Importing validated JSON (RFC 4627) does not split events

timodellai — Wed, 30 Sep 2020 00:04:37 GMT

Hi,
we have a service which is showing details for he latest last 10 executed jobs in a JSON (RFC 4627) format.
I already validated that format with several JSON validators on the web.

Splunk is not splitting the events/jobs.
Do you have a solution for that challenge?

The JSON data is in the following.
The timestamp is in the field changed_at.

{
"monitored_jobs":[
{
"monitored_element_id":52,
"work_order_part_id":10,
"quantity":500,
"priority":4,
"status":{
"value":"HALTED",
"changed_at":"2019-04-10T15:46:55.734Z"
}
},
{
"monitored_element_id":9,
"work_order_part_id":9,
"quantity":500,
"priority":4,
"status":{
"value":"HALTED",
"changed_at":"2019-04-10T14:15:15.837Z"
}
},
{
"monitored_element_id":8,
"work_order_part_id":8,
"quantity":100,
"priority":4,
"status":{
"value":"COMPLETED",
"changed_at":"2019-04-10T13:47:53.763Z"
}
},
{
"monitored_element_id":7,
"work_order_part_id":7,
"quantity":50,
"priority":4,
"status":{
"value":"COMPLETED",
"changed_at":"2019-04-10T13:38:15.803Z"
}
},
{
"monitored_element_id":6,
"work_order_part_id":6,
"quantity":5,
"priority":4,
"status":{
"value":"COMPLETED",
"changed_at":"2019-04-10T13:34:26.396Z"
}
},
{
"monitored_element_id":5,
"work_order_part_id":5,
"quantity":1,
"priority":4,
"status":{
"value":"COMPLETED",
"changed_at":"2019-04-10T11:05:36.366Z"
}
},
{
"monitored_element_id":4,
"work_order_part_id":4,
"quantity":1,
"priority":4,
"status":{
"value":"HALTED",
"changed_at":"2019-04-10T10:53:29.173Z"
}
},
{
"monitored_element_id":3,
"work_order_part_id":3,
"quantity":1,
"priority":4,
"status":{
"value":"COMPLETED",
"changed_at":"2019-04-10T10:46:06.857Z"
}
},
{
"monitored_element_id":2,
"work_order_part_id":2,
"quantity":1,
"priority":4,
"status":{
"value":"HALTED",
"changed_at":"2019-04-10T10:24:22.473Z"
}
},
{
"monitored_element_id":1,
"work_order_part_id":1,
"quantity":1,
"priority":4,
"status":{
"value":"HALTED",
"changed_at":"2019-04-10T09:42:46.452Z"
}
}
],
"page":{
"size":10,
"total_elements":10,
"total_pages":1,
"number":1
}

}

When I try to import that as a file SPLUNK shows me the following:

Re: Importing validated JSON (RFC 4627) does not split events

martin_mueller — Thu, 11 Apr 2019 10:28:12 GMT

You're ingesting one JSON object, so Splunk reads one JSON object.

You could
- generate the data as separate objects
- turn off indexed extractions and use regex to chop the big object into small objects
- use an external preprocessor

topic Re: Importing validated JSON (RFC 4627) does not split events in Getting Data In

Importing validated JSON (RFC 4627) does not split events

}

Re: Importing validated JSON (RFC 4627) does not split events