topic Re: Linebreaking issue with Azure Keyvault sourcetype in Dashboards & Visualizations

Linebreaking issue with Azure Keyvault sourcetype

gazoscreek — Wed, 07 May 2025 14:26:07 GMT

I have multiple formats of json data coming in from Azure Keyvault. I can't seem to get the linebreaking to work properly and Splunk AddOn for Microsoft Cloudservices doesn't provide any props for many of these json blobs.

( multiple matching lines per ingested event }

{ "count": 1, "total": 1, "minimum": 1, "maximum": 1, "average": 1, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiHit", "timeGrain": "PT1M"}
{ "count": 1, "total": 14, "minimum": 14, "maximum": 14, "average": 14, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiLatency", "timeGrain": "PT1M"}

And some look like this:

{ "time": "2025-05-07T14:07:58.7286344Z", "category": "AuditEvent", ....... "13"}
{ "time": "2025-05-07T14:08:02.8617508Z", "category": "AuditEvent", ....... "13"}

I've tried numerous combinations of regexes ... nothing's working.

LINE_BREAKER = (\}([\r\n]\s*,[\r\n]\s*){|\{\s+\"(count|time)\")

Any suggestions would be greatly helpful.

Re: Linebreaking issue with Azure Keyvault sourcetype

kiran_panchavat — Wed, 07 May 2025 14:46:43 GMT

@gazoscreek

I took sample events and tried in my lab, please have a look

Sample events: Mixed Metric and Audit Events

{ "count": 3, "total": 3, "minimum": 3, "maximum": 3, "average": 3, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiError", "timeGrain": "PT1M"}
{
"time": "2025-05-07T14:08:04.9876543Z",
"category": "AuditEvent",
"operationName": "DeleteSecret",
"status": "Succeeded",
"callerIpAddress": "52.191.18.74",
"clientRequestId": "abcdef-12345-67890",
"correlationId": "67890-abcdef-12345",
"resourceId": "/SUBSCRIPTIONS/blah/blah"
}

[sourcetype ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{)
TIME_PREFIX="time":\s*"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%7QZ
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=0
CHARSET=UTF-8
INDEXED_EXTRACTIONS=JSON

Re: Linebreaking issue with Azure Keyvault sourcetype

livehybrid — Wed, 07 May 2025 14:46:00 GMT

Hi @gazoscreek

I think the line breaker regex is too complicated for what you're receiving I would expect the following to work for you:

[azure:keyvault] LINE_BREAKER = ([\r\n]+)\{ SHOULD_LINEMERGE = false TRUNCATE = 0 TIME_PREFIX = \"time\":\s*\" TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%N MAX_TIMESTAMP_LOOKAHEAD = 30

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Linebreaking issue with Azure Keyvault sourcetype

gazoscreek — Wed, 07 May 2025 15:43:57 GMT

Thank you ... both posted solutions worked perfectly. Much appreciated.

Re: Linebreaking issue with Azure Keyvault sourcetype

gazoscreek — Wed, 07 May 2025 15:44:29 GMT

Thank you. THis worked perfectly!