Event Break JSON

[thufirtan]

Hi, I am trying to ingest JSON data into Splunk but I am having difficulties setting up the event breaks. What is the best way to do this?

[Jordan_Brough]

Assuming that each json event blob starts on a new line with an opening brace { Then this seems to be working for me:

[json]
KV_MODE = json
LINE_BREAKER = "(^){"
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = false

[sbitterman]

Where did you specify this logic? In your $SPUNK_HOME/etc/system/local/props.conf? That's where I'm trying to define this logic to get my events correct when using the Splunk Forwarder, but not having any success. 😞

[RaistlinLinden]

I would really like to know the answer to this as we are having the same problem. We are using the splunk cloud and do not know where to put this logic. On a config file on the cloud server?

[mjoseff_splunk]

$SPLUNK_HOME/etc/system/local/props.conf

[lpolo]

I used this approach to address my question:

http://answers.splunk.com/answers/121098/iterate-the-extraction-of-json-objects-using-splunk-query-l...

However, I think that this approach has the problem that the json objects are not split into events. Therefore, any aggregation function will not work as expected. Any idea?

[niordache]

Worked for me ! Json object is not splitted in several events .