Getting Data In

How to edit my props.conf configuration to extract individual events from a JSON array?

dhavamanis
Builder

Can you please tell us how to extract an individual events from json array during the indexing,

Sample input:

{
  "Value": [
    {
      "date": "2016-06-10",
      "applicationId": "app1",
      "applicationName": "T NOW",
      "deviceType": "PC",
      "orderName": "",
      "storeClient": "Windows Store (client)",
      "osVersion": "Windows 10",
      "market": "US",
      "gender": "Unknown",
      "ageGroup": "35-49",
      "acquisitionType": "Free",
      "acquisitionQuantity": 1
    },
    {
      "date": "2016-06-09",
      "applicationId": "app1",
      "applicationName": "T NOW",
      "deviceType": "PC",
      "orderName": "",
      "storeClient": "Store (client)",
      "osVersion": "Windows 8.1",
      "market": "US",
      "gender": "Unknown",
      "ageGroup": "Unknown",
      "acquisitionType": "Free",
      "acquisitionQuantity": 5
    }]
}

We have tried source settings like below in props.conf and seems it is not splitting the events correctly. Can you please provide the correct properties to break events for each values in the json array and assign the date field value as the event's timestamp?

[mobile_win_json]
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
BREAK_ONLY_BEFORE = ^{
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = date
TIME_FORMAT = %Y-%m-%d
TRUNCATE = 0
category = Custom
description = json filed extraction from array of value
disabled = false
pulldown_type = true

ryanoconnor
Builder
  1. The following line can be removed since "SHOULD_LINEMERGE" is set to false.

    BREAK_ONLY_BEFORE = ^{

    1. Can you post a sample JSON event that you're seeing in Splunk? This appears to be valid JSON so it should be extracting.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...