Hi Team,
We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object should be recognized as a separate event, but the configuration is not breaking them apart as expected
I observed that each JSON object has a comma after the closing brace }, which appears to be causing the issue by preventing Splunk from treating each JSON object as a separate event.
sample data :
{
"timestamp":"1727962122",
"phonenumber": "0000000"
"appname": "cisco"
},
{
"timestamp":"1727962123",
"phonenumber": "0000000"
"appname": "windows"
},Error message : Error message : JSON StreamID:0 had parsing error: Unexpected character while looking for value comma ','
Thanks in advance
