All Apps and Add-ons

Line Break Assistance required

Communicator

Hello Splunkers, required yous assistance with a line break for below-mentioned logs at ],[

{"time":1581014469,"states":[["4b1803","SWR55X ","Switzerland",1581014469,1581014469,8.7818,46.8227,6880.86,false,206.91,354.01,-7.8,null,7063.74,"1000",false,0],["3cf0a4","IFA509 ","Germany",1581014469,1581014469,7.9657,46.878,8534.4,false,143.86,32.44,0,null,8679.18,"5344",false,0],["3c6758","DLH1333 ","Germany",1581014469,1581014469,8.545,47.7009,11582.4,false,212.56,30.23,0,null,11681.46,"1030",false,0],["3c5442","DLH02J ","Germany",1581014469,1581014469,6.6594,46.3485,10363.2,false,226.41,39.01,0,null,10492.74,"1000",false,0],["3c658e","DLH15U ","Germany",1581014468,1581014469,9.0273,46.5254,10355.58,false,229.56,358.2,0,null,10347.96,"1000",false,0],["4a8159","SCW3P ","Sweden",1581014469,1581014469,6.9469,46.9315,8557.26,false,221.02,229.15,-10.08,null,8557.26,"0763",false,0],["440344","LDM74J ","Austria",1581014469,1581014469,10.1866,46.0682,5631.18,false,197.18,242.83,-14.96,null,5814.06,"4131",false,0]

current props.conf used for above-mentioned logs is (REST mechanism is used for data integration)

[ geomonitor]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n,])\["
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Thanks in advance

0 Karma
1 Solution

Communicator

As per investigation and testing, able to achieve the required result with

Event Extraction Setting in "Add-on Builder App"

json path 
 $.states[*][1]

View solution in original post

0 Karma

Communicator

As per investigation and testing, able to achieve the required result with

Event Extraction Setting in "Add-on Builder App"

json path 
 $.states[*][1]

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

where's the setting?

0 Karma

SplunkTrust
SplunkTrust
LINE_BREAKER = \[|\](,)

Line breaker

LINE_BREAKER = \[|\](,)
SEDCMD-json_trim = s/(?s){.*//

how about this?

0 Karma

Path Finder

Try

LINE_BREAKER = ]\,[

alt text

0 Karma

SplunkTrust
SplunkTrust

Try LINE_BREAKER = ](,)\[.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Communicator

no working 😞 with

](,)[

0 Karma

SplunkTrust
SplunkTrust

The backslash is necessary.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!