Dashboards & Visualizations

Unable to break JSON events from a REST Modular input (SPLUNK CLOUD) AGAIN

ALXWBR
Path Finder

We are pulling some data from REST using REST API Modular Input (splunkbase.splunk.com/app/1546/), Response type json, and receiving the below response

 

{ 
   currentServerTime: 2021-05-07T07:01:35.652+0000
   measurements: [ 
     { 
       count: 0
       open: true
       resultId: CSA_S_FT_L_ANY
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_ANY
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_7
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_6
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_5
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_4
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_3
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_10
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_2
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_1
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       calculatedTimeInSeconds: 0
       count: 0
       open: true
       resultId: CSA_N_REG_L_2
       time: 00:10:00
       timeInSeconds: 600
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_1
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_10
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_4
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_9
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_3
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_8
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_6
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       calculatedTimeInSeconds: 0
       count: 0
       open: true
       resultId: CSA_N_FT_L_8
       time: 00:05:00
       timeInSeconds: 300
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_5
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_8
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_7
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_FT_L_10
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_REG_L_9
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_FT_L_9
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_REG_L_ANY
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_FT_L_3
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_FT_L_2
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_S_FT_L_1
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
     { 
       count: 0
       open: true
       resultId: CSA_N_FT_L_ANY
       time: 00:00:00
       timeInSeconds: 0
       updated: 2021-05-07T07:01:00.000+0000
     }
   ]
}

 

We would like to split each individual result into individual events using "updated" as the timestamp, however, no matter what I have tried, I can't get Splunk to break the events. 

I've tried writing a custom response handler, but it's not working, this isn't my area of expertise so i'm really struggling! This is what I have written.

 

class BlipTrackHandler:

     def __init__(self,**args):
         pass

     def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
         if response_type == "json":        
             output = json.loads(raw_response_output)

             for measurement in output["measurements"]:
                 measurement["timestamp"] = output["measurements"]["updated"]
                 print_xml_stream(json.dumps(measurement))   
         else:
             print_xml_stream(raw_response_output)

 

Is anyone able to help?

 

Labels (1)
0 Karma

ALXWBR
Path Finder

Solved it myself

class BlipTrackHandler:

     def __init__(self,**args):
         pass

     def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
         if response_type == "json":        
             output = json.loads(raw_response_output)

             for measurement in output["measurements"]:
                 measurement["currentServerTime"] = output["currentServerTime"]
                 print_xml_stream(json.dumps(measurement))   
         else:
             print_xml_stream(raw_response_output)

And changed the sourcetype to json_no_timestamp

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!