Getting Data In

Event Break JSON

thufirtan
Engager

Hi, I am trying to ingest JSON data into Splunk but I am having difficulties setting up the event breaks. What is the best way to do this?

Tags (1)

Jordan_Brough
Path Finder

Assuming that each json event blob starts on a new line with an opening brace { Then this seems to be working for me:

[json]
KV_MODE = json
LINE_BREAKER = "(^){"
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = false

sbitterman
New Member

Where did you specify this logic? In your $SPUNK_HOME/etc/system/local/props.conf? That's where I'm trying to define this logic to get my events correct when using the Splunk Forwarder, but not having any success. 😞

0 Karma

RaistlinLinden
New Member

I would really like to know the answer to this as we are having the same problem. We are using the splunk cloud and do not know where to put this logic. On a config file on the cloud server?

0 Karma

mjoseff_splunk
Splunk Employee
Splunk Employee

$SPLUNK_HOME/etc/system/local/props.conf

0 Karma

lpolo
Motivator

I used this approach to address my question:

http://answers.splunk.com/answers/121098/iterate-the-extraction-of-json-objects-using-splunk-query-l...

However, I think that this approach has the problem that the json objects are not split into events. Therefore, any aggregation function will not work as expected. Any idea?

0 Karma

niordache
Explorer

Worked for me ! Json object is not splitted in several events .

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...