Splunk Dev

How to Split JSON Array into Multiple Events using configuration ?

karajada94
New Member
    {
     "cluster_call_quality":{
      "crPartyId" : "12345",
      "cluster_call_quality_summary":
        [
            {
              "clusterId":"Cluster1",
              "date":"2018-10-03",
              "totalNumberOfCalls":2000,
              "failedCalls" : 1000,
              "degradedCalls":200,
              "failedCallsPercentage" : 50,
              "degradedCallsPercentage":10
            },
            {
              "clusterId":"Cluster2",
              "date":"2018-11-04",
              "totalNumberOfCalls":1200,
              "failedCalls" : 400,
              "degradedCalls":300,
              "failedCallsPercentage" : 33,
              "degradedCallsPercentage":25
            },
            {
              "clusterId":"Cluster3",
              "date":"2018-12-05",
              "totalNumberOfCalls":700,
              "failedCalls" : 350,
              "degradedCalls":100,
              "failedCallsPercentage" : 50,
              "degradedCallsPercentage":14
            }
        ]
    }

    }



Output:-
3 events should come
with each events like below:-

 {
           "clusterId":"Cluster1",
           "date":"2018-10-03",
           "totalNumberOfCalls":2000,
           "failedCalls" : 1000,
           "degradedCalls":200,
           "failedCallsPercentage" : 50,
           "degradedCallsPercentage":10
         }
Tags (1)
0 Karma

FrankVl
Ultra Champion

Use this line breaker config in props.conf

SHOULD_LINEMERGE = false
LINE_BREAKER = (?:\[([\r\n\s]+))|(?:\}(,[\r\n\s]+)\{)|(?:([\r\n\s]+)\])

Which splits of the header, splits the events and splits off the footer closing brackets. You can then add some props and transforms to drop the header and footer bits.

props.conf:

TRANSFORMS-setnull = json-drop-all,json-accept-real

transforms.conf:

[json-drop-all]
REGEX = .*
DEST_KEY = queue
FORMAT = nullQueue

[json-accept-real]
REGEX = clusterId
DEST_KEY = queue
FORMAT = indexQueue
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@karajada94

Basically, you have to add below configuration in props.conf.

[YOUR_SOURCETYPE]
BREAK_ONLY_BEFORE = (\{|\[\s+{)
DATETIME_CONFIG = 
MUST_BREAK_AFTER = (\}|\}\s+\])
NO_BINARY_CHECK = true
SEDCMD-a = s/(^\{)//g
SEDCMD-b = s/(.*cucm_cluster_call_quality.*)//g
SEDCMD-c = s/(.*crPartyId.*)//g
SEDCMD-d = s/(.*cucm_cluster_call_quality_summary.*)//g
SEDCMD-e = s/(.*[\[|\]].*)//g
SEDCMD-f = s/(\n})//g
SEDCMD-h = s/}(,)/}/g
SEDCMD-i = s/(^(?:[\t ]*(?:\r?\n|\r))+)//g
SEDCMD-j = s/(^}$)//g
SEDCMD-k = s/(\s)//g
category = Structured
disabled = false
pulldown_type = true

Can you please try and let me know?

Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...