Getting Data In

JSON events not splitting correctly

pjohnson1
Path Finder

I have some data in the following format which does not split correctly.

The events get indexed as one event.

sample data

{"date": "5/8/2020", "time": "7:57:47 AM", "client": "187.45.18.205", "flags": "A", "query": "v1.addthisedge.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "188.35.138.205", "flags": "A", "query": "m.addthis.com"}{"date": "5/8/2020", "time": "7:57:47 AM", "client": "186.95.16.121", "flags": "A", "query": "cloud.acrobat.com"}

props.conf

[monitor:///data/dns/*/*/*/*.json.log]
INDEXED_EXTRACTIONS = json
KV_MODE = none
Labels (3)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
[monitor:///data/dns/*/*/*/*.json.log]
SHOULD_LINEMERGE = false
LINE_BREAKER = }(\s*)
NO_BINARY_CHECK = true

Well, if you cut it off, there's no problem.

View solution in original post

to4kawa
Ultra Champion
[monitor:///data/dns/*/*/*/*.json.log]
SHOULD_LINEMERGE = false
LINE_BREAKER = }(\s*)
NO_BINARY_CHECK = true

Well, if you cut it off, there's no problem.

to4kawa
Ultra Champion

your JSON is not valid.
, is missing between objects( {\"date...} )
Both INDEXED_EXTRACTIONS and KV_MODE can't work.

0 Karma

pjohnson1
Path Finder

Thank you for answering. I fixed up the json output but still have an issue.

 [{"date": "5/8/2020", "time": "7:57:47 AM", "client": "187.45.18.205", "flags": "A", "query": "v1.addthisedge.com"},{"date": "5/8/2020", "time": "7:57:47 AM", "client": "188.35.138.205", "flags": "A", "query": "m.addthis.com"},{"date": "5/8/2020", "time": "7:57:47 AM", "client": "186.95.16.121", "flags": "A", "query": "cloud.acrobat.com"}]
0 Karma

to4kawa
Ultra Champion

I hope you look my answer before amended.

your json is valid now.

 [monitor:///data/dns/*/*/*/*.json.log]
 INDEXED_EXTRACTIONS = json
 KV_MODE = none

it works.

0 Karma

pjohnson1
Path Finder

Yes, I did. Thank you! 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...