parse json events properly and new line

ashoksamal63 — Sun, 24 Jan 2016 13:06:47 GMT

I have json data coming in. Some times few jsons are coming together.

ex:

json \x00\x00\x00\x00\x00\x00\xA2\x00\x00է\xF9n[\x00\x00\xFF\xFF\xFF\xFF\x00\x00\xC7 json\x00\x00\x00\x00\x00\x00\xA2\x00\x00է\xF9n[\x00\x00\xFF\xFF\xFF\xFF\x00\x00\xC7json.

\x00\x00\x00\x00\x00\x00\xA2\x00\x00է\xF9n[\x00\x00\xFF\xFF\xFF\xFF\x00\x00\xC7 - is not constant always . it has few special char like 'n[', 'է' which keep on changing.

And every json has this kind of string (\x00\x00\x00\x00\x00\x00\xA2\x00\x00է\xF9n[\x00\x00\xFF\xFF\xFF\xFF\x00\x00\xC7) at the beginning or end of it. All i want is.

one json per event
no junk values like (\x00\x00\x00\x00\x00\x00\xA2\x00\x00է\xF9n[\x00\x00\xFF\xFF\xFF\xFF\x00\x00\xC7) in the event

Can some one help here please quickly??? Please

Re: parse json events properly and new line

alemarzu — Mon, 25 Jan 2016 13:15:13 GMT

Hi ashoksamal,

Do you mind sharing an entire event sample so I can help you ?

topic parse json events properly and new line in Splunk Search

parse json events properly and new line

Re: parse json events properly and new line