Issue with parsing Json data

[slipinski]

Hello Splunkers,

I'm facing problem with correct parsing json data. Splunk correctly recognizes data as json sourced, but with default settings, it cannot parse data correctly. It creates fields like: 3b629fbf-be6c-4806-8ceb-1e2b196b6277.currentUtilisation or device31.1.127.out::device54.1.87.in.currentUtilisation. As the main field is irregular I don't know how to set line_breaker which is the most likely main cause of the problem. Can I count on your help?
A chunk of the input file is below.

 {
 	"device31.1.127.out::device54.1.87.in": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device31.1.127.out",
 		"hasBookings": false,
 		"id": "device31.1.127.out::device54.1.87.in",
 		"isActive": false,
 		"name": "Adam",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device54.1.87.in",
 		"usage": {
 			"bookings": [],
 			"id": "device31.1.127.out::device54.1.87.in"
 		}
 	},
 	"device49.1.117.out::device34.1.69.in": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device49.1.117.out",
 		"hasBookings": false,
 		"id": "device49.1.117.out::device34.1.69.in",
 		"isActive": false,
 		"name": "Barek",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device34.1.69.in",
 		"usage": {
 			"bookings": [],
 			"id": "device49.1.117.out::device34.1.69.in"
 		}
 	},
 	"3b629fbf-be6c-4806-8ceb-1e2b196b6277": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device38.1.93.out",
 		"hasBookings": false,
 		"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277",
 		"isActive": false,
 		"name": "Cezary",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device441.1.89.in",
 		"usage": {
 			"bookings": [],
 			"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277"
 		}
 	},
 	"87725874-f760-4e37-9421-168506a05573": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device21.1.75.out",
 		"hasBookings": false,
 		"id": "87725874-f760-4e37-9421-168506a05573",
 		"isActive": false,
 		"name": "Darek",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device61.1.97.in",
 		"usage": {
 			"bookings": [],
 			"id": "87725874-f760-4e37-9421-168506a05573"
 		}
 	}
 }

[inventsekar]

Hi @slipinski would you like index-time or search-time parsing? may i know if you are aware of the command "spath", please suggest, thanks. 

Best Regards,

Sekar

[slipinski]

I would rather use index-time parsing. Honestly speaking I'm not very familiar with "spath" command. Could it help with parsing, even though line _breaker isn't correct?