Getting Data In

How to parse a JSON array delimited by "," into separate events with their unique timestamps?

jensonthottian
Contributor

Sample single event:

[{"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.539Z"}, {"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.542Z"},
{"a":"057.00E09037A","b":"cdw","c":"1.2.7.7","d":"192.168.1.0","date":"2015-12-14T23:25:24.545Z"}]

Please note the above event is an array with elements as JSON's with different timestamps.

Is there an efficient configuration for props.conf to parse the above into 3 different events with their unique timestamps?

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

This will already result in three indexed events with the standard "_json" sourcetype. You can just copy those settings and create your own sourcetype.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

This will already result in three indexed events with the standard "_json" sourcetype. You can just copy those settings and create your own sourcetype.

jensonthottian
Contributor

This is my props.conf for the JSON

LINE_BREAKER = (\x04)
NO_BINARY_CHECK = 0
SHOULD_LINEMERGE = false
pulldown_type = 1
TIME_PREFIX=\,\"date\":\"
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%Z
TZ=UTC
MAX_TIMESTAMP_LOOKAHEAD=300
INDEXED_EXTRACTIONS = JSON

But still its taking the array of JSON's as one event

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Your JSON data has standard xsd:dateTime timestamps, which Splunk will recognize automatically; and you only have one timestamp in there. So I would just get rid of TIME_PREFIX, TIME_FORMAT and TZ.
I would also remove the LINE_BREAKER and let Splunk figure that out based on the JSON structure we understand.

Note that INDEXED_EXTRACTIONS needs to be configured on the source system, where the logs are picked up (a Universal Forwarder, in most cases).

0 Karma

jensonthottian
Contributor

thanks for the update. I used the above props.conf without the line breaker and it worked well. Thanks again for your help.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...