How to configure Splunk to parse and recognize key value pairs with brackets in my sample data?

[smudge797]

I have single event looking like below and trying to figure the best way for Splunk to recognize the key-value pairs. Ideally would have each line as a separate event.

{
  "compsModelObjectName": "Desktop",
  "compsObjectList": [
    {
      "buildGUID": "8D36EF88-3319-4770-BDD3-DCDA614C40DB",
      "buildType": "ONEDESK - FULLBUILD",
      "buildVersion": "2.22.080214-1002",
      "description": "MY TEXT IN HERE",
      "purpose": "Normal",
      "lastScanDate": "Apr 29, 2010",
      "assetName": "WLDNETSBWGS41J",
      "dateModified": "Mar 27, 2013",
      "dateInstalled": "Dec 17, 2009",
      "invNo": "DIMS-1268745",
      "serialNo": "BWGS41J",
      "manufacturer": "UNKNOWN",
      "model": "UNKNOWN PC",
      "assetTag": "Z00880152",
      "status": "INAC",
      "productClass": "UNKNOWN PC",
      "productType": "UNKNOWN",
      "owner": "X1111111",
      "subStatus": "Disposal",
      "compsIdentifier": "DIMS-1268745"
    },
    {
      "buildGUID": "JENYX1111111XP",
      "buildType": "JENY",
      "description": "Unknown Class",
      "purpose": "Normal",
      "lastScanDate": "Nov 1, 2010",
      "assetName": "JENYX1111111XP",
      "dateModified": "Mar 31, 2011",
      "dateInstalled": "Jan 1, 1970",
      "invNo": "TEXTTEXT",
      "serialNo": "JENYX1111111XP",
      "manufacturer": "JENY",
      "model": "JENY",
      "assetTag": "D04936865",
      "status": "INAC",
      "productClass": "JENY",
      "productType": "JENY",
      "owner": "X1111111",
      "subStatus": "Disposal",
      "compsIdentifier": "DIMS-4182421"
    },
    {
      "buildGUID": "JENYX1111111",
      "buildType": "JENY",
      "description": "Unknown Class",
      "purpose": "Normal",
      "lastScanDate": "Nov 21, 2011",
      "assetName": "JENYX1111111",
      "dateModified": "Nov 20, 2011",
      "dateInstalled": "Jan 1, 1970",
      "invNo": "DIMS-4827747",
      "serialNo": "JENYX1111111",
      "manufacturer": "JENY",
      "model": "JENY",
      "assetTag": "D06722795",
      "status": "INAC",
      "productClass": "JENY",
      "productType": "JENY",
      "owner": "X1111111",
      "subStatus": "Disposal",
      "compsIdentifier": "DIMS-4827747"
    },
    {
      "buildGUID": "2DB77FB4-C1D2-4AD4-9453-4A06D4017076",
      "buildType": "xSPACE - FULLBUILD",
      "buildVersion": "4.12",
      "description": "Business Basic PC",
      "domain": "EMEA",
      "purpose": "Normal",
      "lastScanDate": "Aug 30, 2016",
      "assetName": "WC2291Y7F",
      "dateModified": "Aug 31, 2016",
      "dateInstalled": "Jun 24, 2013",
      "invNo": "DIMS-5916063",
      "serialNo": "CZC2291Y7F",
      "manufacturer": "DP",
      "model": "Z611",
      "assetTag": "08192",
      "status": "AC",
      "productClass": "Desktop",
      "productType": "DESKTOP",
      "owner": "X1111111",
      "subStatus": "CONFIGURED",
      "compsIdentifier": "DIMS-5916063"
    }
  ],
  "statusCode": 200
}

[smudge797]

Set in system local in indexers and still no change. 😞

[sundareshr]

If you are using a custom sourcetype, you can try adding INDEXED_EXTRACTION = JSON to your props.conf for your sourcetype.

https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Propsconf