Getting Data In

Issue with parsing Json data

slipinski
Loves-to-Learn

Hello Splunkers,

I'm facing problem with correct parsing json data. Splunk correctly recognizes data as json sourced, but with default settings, it cannot parse data correctly. It creates fields like: 3b629fbf-be6c-4806-8ceb-1e2b196b6277.currentUtilisation or device31.1.127.out::device54.1.87.in.currentUtilisation. As the main field is irregular I don't know how to set line_breaker which is the most likely main cause of the problem. Can I count on your help?
A chunk of the input file is below.

 

 

 {
 	"device31.1.127.out::device54.1.87.in": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device31.1.127.out",
 		"hasBookings": false,
 		"id": "device31.1.127.out::device54.1.87.in",
 		"isActive": false,
 		"name": "Adam",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device54.1.87.in",
 		"usage": {
 			"bookings": [],
 			"id": "device31.1.127.out::device54.1.87.in"
 		}
 	},
 	"device49.1.117.out::device34.1.69.in": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device49.1.117.out",
 		"hasBookings": false,
 		"id": "device49.1.117.out::device34.1.69.in",
 		"isActive": false,
 		"name": "Barek",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device34.1.69.in",
 		"usage": {
 			"bookings": [],
 			"id": "device49.1.117.out::device34.1.69.in"
 		}
 	},
 	"3b629fbf-be6c-4806-8ceb-1e2b196b6277": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device38.1.93.out",
 		"hasBookings": false,
 		"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277",
 		"isActive": false,
 		"name": "Cezary",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device441.1.89.in",
 		"usage": {
 			"bookings": [],
 			"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277"
 		}
 	},
 	"87725874-f760-4e37-9421-168506a05573": {
 		"currentUtilisation": 0.0,
 		"enabled": true,
 		"from": "device21.1.75.out",
 		"hasBookings": false,
 		"id": "87725874-f760-4e37-9421-168506a05573",
 		"isActive": false,
 		"name": "Darek",
 		"props": {
 			"bandwidth": 90000.0,
 			"conflictPri": 1,
 			"description": ""
 		},
 		"to": "device61.1.97.in",
 		"usage": {
 			"bookings": [],
 			"id": "87725874-f760-4e37-9421-168506a05573"
 		}
 	}
 }

 

 

Labels (1)
0 Karma

inventsekar
Super Champion

Hi @slipinski would you like index-time or search-time parsing? may i know if you are aware of the command "spath", please suggest, thanks. 

 

Best Regards,

Sekar

0 Karma

slipinski
Loves-to-Learn

I would rather use index-time parsing. Honestly speaking I'm not very familiar with "spath" command. Could it help with parsing, even though line _breaker isn't correct?

0 Karma