Archive

How can I split JSON into multiple events?

Path Finder

Hi,

can anyone help me a bit? i am trying to split an event in more lines or more events, every events got multiple lines starting with the below

{"class":

what i want is to parse every line as separated event

i tried with line breaker and event breaker, but i am not really god at regex

props.conf

[source:/opt/api/shared/log/sidekiq.log]
EVENT_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false

also i got this error message in splunkd.log

AggregatorMiningProcessor - Changing breaking behavior for event stream because MAX_EVENTS (256) was exceeded without a single event break. Will set BREAK_ONLY_BEFORE_DATE to False, and unset any MUST_NOT_BREAK_BEFORE or MUST_NOT_BREAK_AFTER rules. Typically this will amount to treating this data as single-line only. - data_source="/log/sidekiq.log", data_host="blabla", data_sourcetype="ruby_on_rails"

Thanks!

Tags (1)
0 Karma
1 Solution

Motivator

Hi! I think you are missing a colon in the first line. Try

[source::/opt/api/shared/log/sidekiq.log]

instead of

[source:/opt/api/shared/log/sidekiq.log]

View solution in original post

0 Karma

Motivator

Hi! I think you are missing a colon in the first line. Try

[source::/opt/api/shared/log/sidekiq.log]

instead of

[source:/opt/api/shared/log/sidekiq.log]

View solution in original post

0 Karma

Path Finder

well that did the trick! Thanks

now i need to parse the nested list inside the same line.

i'll have a look around here propably there is already the answer

i am trying with spath but is not working

i got something like:

{"class":"EventsWorker","args":["{\"id\"=187918,....]

i can't extract args, i tried:

mysearch | spath path=args{} output=args
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!