https://community.splunk.com/t5/Splunk-Search/how-to-get-items-from-a-large-json-file/m-p/377782#M169783 <P>Hi everyone</P> <P>I´m new in splunk ,I need to get items from a json file but when i search in my file i see this in many parts and i don´t get all entities that i need.</P> <P>How can i configure splunk to read json in only one event and so i can to get all entities ?</P> <P>On image i have 3 events from same json file i need only one event and so get all entities from this json .</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4892i363339C7BECECA0B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 30 Apr 2018 15:48:56 GMT cleal 2018-04-30T15:48:56Z https://community.splunk.com/t5/Splunk-Search/how-to-get-items-from-a-large-json-file/m-p/377782#M169783 <P>Hi everyone</P> <P>I´m new in splunk ,I need to get items from a json file but when i search in my file i see this in many parts and i don´t get all entities that i need.</P> <P>How can i configure splunk to read json in only one event and so i can to get all entities ?</P> <P>On image i have 3 events from same json file i need only one event and so get all entities from this json .</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4892i363339C7BECECA0B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 30 Apr 2018 15:48:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-items-from-a-large-json-file/m-p/377782#M169783 cleal 2018-04-30T15:48:56Z https://community.splunk.com/t5/Splunk-Search/how-to-get-items-from-a-large-json-file/m-p/377783#M169784 <P>The general answer is to add <CODE>| spath</CODE> to your search and go from there. That command has many options and you can call it multiple times with filtering and renaming steps between:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath</A></P> Mon, 30 Apr 2018 16:09:40 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-items-from-a-large-json-file/m-p/377783#M169784 woodcock 2018-04-30T16:09:40Z