Getting Data In

Help extracting json at index time

olegr
Engager

Hello,

I have a scripted input that runs a py script which returns json in this format in a single line:

 

 

[
    {
        "address": "blah@blah.com",
        "timeRanges":
        [
            {
                "start": "2023-05-22T12:59:00.000Z",
                "end": "2023-05-25T13:48:19.000Z",
            },
            {
                "start": "2023-06-12T04:06:56.000Z",
            }
        ],
    },
    {
        "address": "blah1@blah1.com",
        "timeRanges":
        [
            {
                "start": "2023-07-01T15:00:00.000Z",
                "end": "2023-07-05T04:38:08.000Z",
            }
        ],
   }
]

 

 

 

Splunk indexes everything as a single record as below.

olegr_0-1689026255162.png

Looking for a way to extract each object into its own record.  When I import the file via the GUI, it parses it correctly, but not via the scripted input.  Props:

[my-source-type]
NO_BINARY_CHECK = true
INDEXED_EXTRACTIONS = json
KV_MODE = none
SHOULD_LINEMERGE = true
TRUNCATE = 0

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...