Getting Data In

JSON Data extraction issues with Comma

kumva01
Loves-to-Learn Lots

Hi Team,

We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object should be recognized as a separate event, but the configuration is not breaking them apart as expected

 kumva01_0-1730178348522.png

I observed that each JSON object has a comma after the closing brace }, which appears to be causing the issue by preventing Splunk from treating each JSON object as a separate event.

sample data : 

{ 

  "timestamp":"1727962122",

  "phonenumber": "0000000"

  "appname": "cisco"

},

{ 

  "timestamp":"1727962123",

  "phonenumber": "0000000"

  "appname": "windows"

},

 Error message : Error message : JSON StreamID:0 had parsing error: Unexpected character while looking for value comma ','

Thanks in advance

Labels (1)
0 Karma

tej57
Contributor

Hello @kumva01,

Can you explain more about what is the source and how are you trying to ingest the data? What will be the data flow? Just the props configuration will not be able to help you with breaking the events and maintaining the JSON format for further field extractions.

 

Thanks,
Tejas. 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...