Getting Data In

Issue with a log JSON

rafamss
Contributor

Hi guys,

I'm having a issues with a log data file in the following format (JSON):

{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 250,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 100,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 250,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 700,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 240,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 100,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 600,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 950,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 190,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}

The Splunk only recognizes the file as a unique line. What do I do ?

Rafael Martins

Tags (2)
0 Karma
1 Solution

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

View solution in original post

0 Karma

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

0 Karma

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

0 Karma

somesoni2
Revered Legend

Since your data don't have timestamp (for each event), SPlunk is considering whole file content as one event. When seeing the preview of the log file during import, click on 'adjust timestamp and event break settings' link (in top section). Then in 'Event breaks' tab, select option "specify patter..." and provide this value {"widget" . Click on apply and continue with other things that your were doing so far.

rafamss
Contributor

I created a new source type and inserted the data log file into directory that was already previously configured. I consider this is the simplest way to do this.

0 Karma

somesoni2
Revered Legend

did you configure the event breaking or your just went ahead with default values?

0 Karma

rafamss
Contributor

I created through Splunk Web.

0 Karma

somesoni2
Revered Legend

You've create data input from Splunk Web or directly from props.conf?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...