Getting Data In

Issue with a log JSON

rafamss
Contributor

Hi guys,

I'm having a issues with a log data file in the following format (JSON):

{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 250,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 100,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 250,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 700,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 500,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 240,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 100,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}
{"widget": {
"debug": "on",
"window": {
"title": "Sample Konfabulator Widget",
"name": "main_window",
"width": 600,
"height": 500
},
"image": {
"src": "Images/Sun.png",
"name": "sun1",
"hOffset": 950,
"vOffset": 250,
"alignment": "center"
},
"text": {
"data": "Click Here",
"size": 36,
"style": "bold",
"name": "text1",
"hOffset": 250,
"vOffset": 190,
"alignment": "center",
"onMouseUp": "sun1.opacity = (sun1.opacity / 100) * 90;"
}
}}

The Splunk only recognizes the file as a unique line. What do I do ?

Rafael Martins

Tags (2)
0 Karma
1 Solution

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

View solution in original post

0 Karma

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

0 Karma

rafamss
Contributor

Hi somesoni2, Your example worked fine. Thanks!

0 Karma

somesoni2
Revered Legend

Since your data don't have timestamp (for each event), SPlunk is considering whole file content as one event. When seeing the preview of the log file during import, click on 'adjust timestamp and event break settings' link (in top section). Then in 'Event breaks' tab, select option "specify patter..." and provide this value {"widget" . Click on apply and continue with other things that your were doing so far.

rafamss
Contributor

I created a new source type and inserted the data log file into directory that was already previously configured. I consider this is the simplest way to do this.

0 Karma

somesoni2
Revered Legend

did you configure the event breaking or your just went ahead with default values?

0 Karma

rafamss
Contributor

I created through Splunk Web.

0 Karma

somesoni2
Revered Legend

You've create data input from Splunk Web or directly from props.conf?

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...