Getting Data In

Breaking events JSON

Path Finder

For some reason the LINE_BREAKER option for Splunk keeps turning a JSON log file into a single event, ignoring everything after the first event. Does anyone have any experience with breaking the events up for the following log?:

{"aModLR":{"attributes":{"affected":"topology/pod/node/av/node","cause":"transition","changeSet":"targetMn (Old: AAA, New: BBB)","childAction":"","clientTag":"","code":"E69","created":"2019-07-18T16:38:41.501+02:00","descr":"Node modified","dn":"subj-[topology/pod/node/av/node]/mod-43243","id":"23432","ind":"modification","modTs":"never","sessionId":"ABCD",severity":"info","status":"","trig":"config","txId":"18374686479671625257","user":"admin"}}},{"aModLR":{"attributes":{"affected":"pluginPolContr/pluginPol","cause":"transition","changeSet":"verifySignature:enable","childAction":"","clientTag":"","code":"E68","created":"2019-07-18T10:31:11.748+02:00","descr":"PluginPol created","dn":"subj-[pluginPolContr/pluginPol]/mod-1234","id":"12345","ind":"creation","modTs":"never","sessionId":"ABCDEF123",severity":"info","status":"","trig":"config","txId":"5645","user":"admin2"}}}

I've tried BREAK_ONLY_BEFORE = {"aModLR" or LINE_BREAKER = {"aModLR() but it still turns it into a single event.

0 Karma

SplunkTrust
SplunkTrust
LINE_BREAKER = \{\"aModLR\"

I think you need to escape the string.

| makeresults 
| eval _raw="{\"aModLR\":{\"attributes\":{\"affected\":\"topology/pod/node/av/node\",\"cause\":\"transition\",\"changeSet\":\"targetMn (Old: AAA, New: BBB)\",\"childAction\":\"\",\"clientTag\":\"\",\"code\":\"E69\",\"created\":\"2019-07-18T16:38:41.501+02:00\",\"descr\":\"Node modified\",\"dn\":\"subj-[topology/pod/node/av/node]/mod-43243\",\"id\":\"23432\",\"ind\":\"modification\",\"modTs\":\"never\",\"sessionId\":\"ABCD\",\"severity\":\"info\",\"status\":\"\",\"trig\":\"config\",\"txId\":\"18374686479671625257\",\"user\":\"admin\"}}}"
| appendpipe 
    [eval _raw="{\"aModLR\":{\"attributes\":{\"affected\":\"pluginPolContr/pluginPol\",\"cause\":\"transition\",\"changeSet\":\"verifySignature:enable\",\"childAction\":\"\",\"clientTag\":\"\",\"code\":\"E68\",\"created\":\"2019-07-18T10:31:11.748+02:00\",\"descr\":\"PluginPol created\",\"dn\":\"subj-[pluginPolContr/pluginPol]/mod-1234\",\"id\":\"12345\",\"ind\":\"creation\",\"modTs\":\"never\",\"sessionId\":\"ABCDEF123\",\"severity\":\"info\",\"status\":\"\",\"trig\":\"config\",\"txId\":\"5645\",\"user\":\"admin2\"}}}"]
| rex mode=sed "s/({|\\\",)/\1\n/g"
| spath

I tried extracting fields with a query as an example.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!