Hello Splunkers, required yous assistance with a line break for below-mentioned logs at ],[
{"time":1581014469,"states":[["4b1803","SWR55X ","Switzerland",1581014469,1581014469,8.7818,46.8227,6880.86,false,206.91,354.01,-7.8,null,7063.74,"1000",false,0],["3cf0a4","IFA509 ","Germany",1581014469,1581014469,7.9657,46.878,8534.4,false,143.86,32.44,0,null,8679.18,"5344",false,0],["3c6758","DLH1333 ","Germany",1581014469,1581014469,8.545,47.7009,11582.4,false,212.56,30.23,0,null,11681.46,"1030",false,0],["3c5442","DLH02J ","Germany",1581014469,1581014469,6.6594,46.3485,10363.2,false,226.41,39.01,0,null,10492.74,"1000",false,0],["3c658e","DLH15U ","Germany",1581014468,1581014469,9.0273,46.5254,10355.58,false,229.56,358.2,0,null,10347.96,"1000",false,0],["4a8159","SCW3P ","Sweden",1581014469,1581014469,6.9469,46.9315,8557.26,false,221.02,229.15,-10.08,null,8557.26,"0763",false,0],["440344","LDM74J ","Austria",1581014469,1581014469,10.1866,46.0682,5631.18,false,197.18,242.83,-14.96,null,5814.06,"4131",false,0]
current props.conf
used for above-mentioned logs is (REST mechanism is used for data integration)
[ geomonitor]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n,])\["
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true
Thanks in advance
As per investigation and testing, able to achieve the required result with
Event Extraction Setting in "Add-on Builder App"
json path
$.states[*][1]
As per investigation and testing, able to achieve the required result with
Event Extraction Setting in "Add-on Builder App"
json path
$.states[*][1]
where's the setting?
LINE_BREAKER = \[|\](,)
LINE_BREAKER = \[|\](,)
SEDCMD-json_trim = s/(?s){.*//
how about this?
Try LINE_BREAKER = ](,)\[
.
no working 😞 with
](,)[
The backslash is necessary.