Getting Data In

Headaches loading JSON log file

kmcarrol
Path Finder

My apologies if this is elementary... I know the following snippet from my JSON log file is not structurally sound but even cleaning it up by adding the proper closing braces and brackets did not help. I have two log files - one that details direct 1:1 orders (order=X, targetId=y) and the other details batch orders (order=x, targetID=a,b,c). The first is in a simple rows and columns format and I have ingested it just fine. The second is in JSON format. I can't seem to figure out how to load the file into Splunk via Add Data. I have tried both the original format and the structurally correct format below. I know how to use the multi-value commands once I get the data in. I just can't see to figure out how to get the data in. Any help would be greatly appreciated!

Original format:

5435545 {
"culture": "en-US",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "EntityIds",
"original_value": null,
"new_value": [
1067526,
1067525,
1067521,
5435547 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "ExternalReference",
"original_value": null,
"new_value": "c18a3263-f5b3-4d41-9c44-a48d00d901e9"
},
{
5436549 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "Status",
"original_value": "Created",
"new_value": "Completed"
},
{
"property": "PackageType",

Corrected format:

5435545 {
"culture": "en-US",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "EntityIds",
"original_value": null,
"new_value": [
1067526,
1067525,
1067521
]
}
]
}
5435547 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "ExternalReference",
"original_value": null,
"new_value": "c18a3263-f5b3-4d41-9c44-a48d00d901e9"
}
]
}
5436549 {
"culture": "",
"name": "M.Order:1875681",
"definition": "M.Order",
"property_changes": [
{
"property": "Status",
"original_value": "Created",
"new_value": "Completed"
},
{
"property": "PackageType"
}
]
}

Tags (2)
0 Karma
1 Solution

jimmpoul
Explorer

Your corrected format is still not a valid JSON document. It has to start with a curly brace. I suggest that you make sure it is valid first in a JSON editor ex: https://www.jsoneditoronline.org/

View solution in original post

jimmpoul
Explorer

Your corrected format is still not a valid JSON document. It has to start with a curly brace. I suggest that you make sure it is valid first in a JSON editor ex: https://www.jsoneditoronline.org/

kmcarrol
Path Finder

Sure enough! Thanks a lot! I especially appreciate the reference since this is for Splunk Answers, not JSON Answers. 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...