Getting Data In

How to edit my props.conf configuration to extract individual events from a JSON array?

dhavamanis
Builder

Can you please tell us how to extract an individual events from json array during the indexing,

Sample input:

{
  "Value": [
    {
      "date": "2016-06-10",
      "applicationId": "app1",
      "applicationName": "T NOW",
      "deviceType": "PC",
      "orderName": "",
      "storeClient": "Windows Store (client)",
      "osVersion": "Windows 10",
      "market": "US",
      "gender": "Unknown",
      "ageGroup": "35-49",
      "acquisitionType": "Free",
      "acquisitionQuantity": 1
    },
    {
      "date": "2016-06-09",
      "applicationId": "app1",
      "applicationName": "T NOW",
      "deviceType": "PC",
      "orderName": "",
      "storeClient": "Store (client)",
      "osVersion": "Windows 8.1",
      "market": "US",
      "gender": "Unknown",
      "ageGroup": "Unknown",
      "acquisitionType": "Free",
      "acquisitionQuantity": 5
    }]
}

We have tried source settings like below in props.conf and seems it is not splitting the events correctly. Can you please provide the correct properties to break events for each values in the json array and assign the date field value as the event's timestamp?

[mobile_win_json]
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
BREAK_ONLY_BEFORE = ^{
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = date
TIME_FORMAT = %Y-%m-%d
TRUNCATE = 0
category = Custom
description = json filed extraction from array of value
disabled = false
pulldown_type = true

ryanoconnor
Builder
  1. The following line can be removed since "SHOULD_LINEMERGE" is set to false.

    BREAK_ONLY_BEFORE = ^{

    1. Can you post a sample JSON event that you're seeing in Splunk? This appears to be valid JSON so it should be extracting.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...