Line Break Assistance required

[sumanssah]

Hello Splunkers, required yous assistance with a line break for below-mentioned logs at ],[

{"time":1581014469,"states":[["4b1803","SWR55X ","Switzerland",1581014469,1581014469,8.7818,46.8227,6880.86,false,206.91,354.01,-7.8,null,7063.74,"1000",false,0],["3cf0a4","IFA509 ","Germany",1581014469,1581014469,7.9657,46.878,8534.4,false,143.86,32.44,0,null,8679.18,"5344",false,0],["3c6758","DLH1333 ","Germany",1581014469,1581014469,8.545,47.7009,11582.4,false,212.56,30.23,0,null,11681.46,"1030",false,0],["3c5442","DLH02J ","Germany",1581014469,1581014469,6.6594,46.3485,10363.2,false,226.41,39.01,0,null,10492.74,"1000",false,0],["3c658e","DLH15U ","Germany",1581014468,1581014469,9.0273,46.5254,10355.58,false,229.56,358.2,0,null,10347.96,"1000",false,0],["4a8159","SCW3P ","Sweden",1581014469,1581014469,6.9469,46.9315,8557.26,false,221.02,229.15,-10.08,null,8557.26,"0763",false,0],["440344","LDM74J ","Austria",1581014469,1581014469,10.1866,46.0682,5631.18,false,197.18,242.83,-14.96,null,5814.06,"4131",false,0]

current props.conf used for above-mentioned logs is (REST mechanism is used for data integration)

[ geomonitor]
CHARSET=UTF-8
DATETIME_CONFIG=CURRENT
LINE_BREAKER=([\r\n,])\["
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Thanks in advance

[sumanssah · Accepted solution]

As per investigation and testing, able to achieve the required result with

Event Extraction Setting in "Add-on Builder App"

json path 
 $.states[*][1]

[to4kawa]

where's the setting?

[to4kawa]

LINE_BREAKER = \[|\](,)

LINE_BREAKER = \[|\](,)
SEDCMD-json_trim = s/(?s){.*//

how about this?

[abhijeet01]

Try

LINE_BREAKER = ]\,[

[richgalloway]

Try LINE_BREAKER = ](,)\[.

[sumanssah]

no working 😞 with

](,)[

[richgalloway]

The backslash is necessary.