Getting Data In

How to parse json related log file during index time?

divya_gn1
Loves-to-Learn

Hi,

I need help with parsing below data that is pulled from a python script. The data is pushed to system output and script monitoring is in place to read the data.  Below sample Json format data is printed to system output. 

And below is the props currently present. The data has to be divided into multiple events after "tags."

 

[sourcetype_name]

KV_MODE = json
SHOULD_LINEMERGE = false
disabled = false
CHARSET = UTF-8
TRUNCATE = 0
LINE_BREAKER = \"tags\":\[[\w\W].*\}\,\{\"id\":
SEDCMD-remove_trailing_comma = s/\},\s/}/g

 

Sample data.

[{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'name', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_status': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'whois_privacy': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['domain_name_service1.xyz3.abc.net', 'domain_name_service2.xyz3.abc.net', 'domain_name_service3.xyz3.abc.net', 'domain_name_service4.xyz3.abc.net', 'xyz1.abc.com', 'xyz2.abc.com', 'xyz3.abc.com', 'xyz4.abc.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'Domain Administrator', 'email': '[email protected]', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'company name', 'street1': 'address', 'street2': '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'Domain Administrator', 'email': 'email', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'city_details Chocolate & Confectionery LLC', 'street1': '19 East Chocolate Avenue', 'street2': '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'Technical Manager', 'email': 'webops@city_detailss.com', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'company name', 'street1': 'address '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'city_details Co (Primary)', 'contracting_company': 'consonum', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'city_details Co'}}, 'active_zone': None, 'domain_name_servicesec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'name', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_status': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'whois_privacy': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['domain_name_service1.xyz3.abc.net', 'domain_name_service2.xyz3.abc.net', 'domain_name_service3.xyz3.abc.net', 'domain_name_service4.xyz3.abc.net', 'xyz1.abc.com', 'xyz2.abc.com', 'xyz3.abc.com', .... this continues till the end of the log file}]

 

The highlighted portion is where next ID starts. that shud be next event, but in Splunk everything is coming as a single event. Please help.

Thanks in advance.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting requires a capture group.  The contents of the capture group will be replaced with an event break.  Try this

LINE_BREAKER = "tags":\[[\w\W].*\}(,)\{"id":
---
If this reply helps you, Karma would be appreciated.
0 Karma

divya_gn1
Loves-to-Learn

@richgalloway , Thanks. the regex worked after a little tweak. But surprisingly, one set of data from API contains 25 entries, only 15 are ingested, 10 are ignored. These 10 are randomly selected. Not sure what might be the issue. Is it possible to identify please ?

I have used below props

[sourcetype_name]
KV_MODE = json
SHOULD_LINEMERGE = false
disabled = false
CHARSET = UTF-8
TRUNCATE = 0
LINE_BREAKER = \'tags\':\s\[[\w\W].*\}(,)\s\{\'id\':

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Computers aren't random so there must be something different about the data that is causing different behavior. Perhaps spaces are inconsistent.

LINE_BREAKER = \'tags\':\s*\[[\w\W].*\}(,)\s*\{\'id\':

If you share sanitized samples of events that are not breaking properly then we may be able to find a better regex.

---
If this reply helps you, Karma would be appreciated.
0 Karma

divya_gn1
Loves-to-Learn

@richgalloway , thanks. Here is the data that gets generated from script. Whatever id that comes after tags, should be coming as next event.  I could not paste the complete log file, a sample is written.

[{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'xyz', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'xya.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': 'd1aa99ab-0548-4e85-9a17-1aec09c114a1', 'name': 'amplifysnacks.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-03-30T00:00:00Z', 'expires_at': '2024-02-10T00:00:00Z', 'updated_at': '2022-04-17T04:18:37Z', 'created_at': '2022-04-01T15:23:31Z', 'managed_at': '2022-04-17T04:18:36Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}]

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How many events are in that sample?  My sandbox finds 3 using your props.conf settings.

---
If this reply helps you, Karma would be appreciated.
0 Karma

divya_gn1
Loves-to-Learn

This has 3 events, but whenever I am checking for the actual log file, that doesn't get divided.  I can't upload complete log file. Can you try with this log, it has events which is not breaking. So.

[{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'xyz', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'xya.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': 'a3c99348-89c4-48a6-afc5-7a487e0ee069', 'name': '5thxyzstore.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2018-07-13T00:00:00Z', 'expires_at': '2024-07-13T00:00:00Z', 'updated_at': '2023-06-13T23:16:00Z', 'created_at': '2021-12-03T11:40:57Z', 'managed_at': '2021-12-21T06:30:20Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '51654e60-a963-41ef-9844-0c0b3a30162d', 'name': 'xyz.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2002-12-11T00:00:00Z', 'expires_at': '2024-12-11T00:00:00Z', 'updated_at': '2023-04-06T04:20:55Z', 'created_at': '2023-03-29T18:56:56Z', 'managed_at': '2023-04-06T04:20:54Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': '[email protected]', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}]

Tags (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...