Linebreaking issue with Azure Keyvault sourcetype

[gazoscreek]

I have multiple formats of json data coming in from Azure Keyvault. I can't seem to get the linebreaking to work properly and Splunk AddOn for Microsoft Cloudservices doesn't provide any props for many of these json blobs.

( multiple matching lines per ingested event }

{ "count": 1, "total": 1, "minimum": 1, "maximum": 1, "average": 1, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiHit", "timeGrain": "PT1M"}
{ "count": 1, "total": 14, "minimum": 14, "maximum": 14, "average": 14, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiLatency", "timeGrain": "PT1M"}

And some look like this:

{ "time": "2025-05-07T14:07:58.7286344Z", "category": "AuditEvent", ....... "13"}
{ "time": "2025-05-07T14:08:02.8617508Z", "category": "AuditEvent", ....... "13"}


I've tried numerous combinations of regexes ... nothing's working.

LINE_BREAKER = (\}([\r\n]\s*,[\r\n]\s*){|\{\s+\"(count|time)\")

Any suggestions would be greatly helpful.

[livehybrid · Accepted solution]

Hi @gazoscreek 

I think the line breaker regex is too complicated for what you're receiving I would expect the following to work for you:

[azure:keyvault]
LINE_BREAKER = ([\r\n]+)\{
SHOULD_LINEMERGE = false
TRUNCATE = 0
TIME_PREFIX = \"time\":\s*\"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%N
MAX_TIMESTAMP_LOOKAHEAD = 30

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[gazoscreek]

Thank you. THis worked perfectly!

[kiran_panchavat]

@gazoscreek 

I took sample events and tried in my lab, please have a look 

Sample events: Mixed Metric and Audit Events

{ "count": 3, "total": 3, "minimum": 3, "maximum": 3, "average": 3, "resourceId": "/SUBSCRIPTIONS/blah/blah", "time": "2025-05-07T14:08:00.0000000Z", "metricName": "ServiceApiError", "timeGrain": "PT1M"}
{
"time": "2025-05-07T14:08:04.9876543Z",
"category": "AuditEvent",
"operationName": "DeleteSecret",
"status": "Succeeded",
"callerIpAddress": "52.191.18.74",
"clientRequestId": "abcdef-12345-67890",
"correlationId": "67890-abcdef-12345",
"resourceId": "/SUBSCRIPTIONS/blah/blah"
}

[sourcetype ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{)
TIME_PREFIX="time":\s*"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%7QZ
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=0
CHARSET=UTF-8
INDEXED_EXTRACTIONS=JSON

[gazoscreek]

Thank you ... both posted solutions worked perfectly. Much appreciated.