i have json data but all the data getting in single event not parsing properly each event
here is adding the event data. Please help what should i do to achieve in standard format in splunk
this is in splunk cloud
ev
This looks like a perfectly reasonable event to ingest whole - you should specify that it is JSON format for extraction purposes, and you can use the json_* functions to manipulate the data in your searches. Is it just that you need help to find the timestamp for the event or is Splunk already doing that correctly?
here is the raw file and i have tried this by uploading for test file but not getting events in proper format
when trying to ingest
all data is getting on one event not as separate inside this separate objects are there
do i need to modify the file structure or need to configure props at host level ?
If you want to have your array from the "queue_mem_check" field ingested as separate events I'm afraid you'll have to preprocess it with an external tool before getting this data to Splunk.
Apart from the fact that this is not quite valid JSON, what have you tried? what are you getting? what are you expecting?
i am testing this data by uploading in splunk cloud but i am not getting events in proper format
when i am selectin sourcetype as json in settings given screen shot
[
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "General_parameters",
"check_status": "OK",
"database_major_version": "19",
"database_minor_version": "0",
"database_name": "C2N48617",
"database_version": "19.0.0.0.0",
"extract_date": "30/07/2024 08:09:06",
"host_name": "flosclnrhv03.pharma.aventis.com",
"instance_name": "C2N48617",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "LIVE2459_VAL",
"check_key_4": "AQ$_Q_TASKREPORTWORKTASK_TAB_E",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "AQ$_Q_TASKREPORTWORKTASK_TAB_E",
"queue_owner": "LIVE2459_VAL",
"queue_sharable_mem": "4072",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "LIVE2459_VAL",
"check_key_4": "AQ$_Q_PIWORKTASK_TAB_E",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "AQ$_Q_PIWORKTASK_TAB_E",
"queue_owner": "LIVE2459_VAL",
"queue_sharable_mem": "4072",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "LIVE2459_VAL",
"check_key_4": "AQ$_Q_LABELWORKTASK_TAB_E",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "AQ$_Q_LABELWORKTASK_TAB_E",
"queue_owner": "LIVE2459_VAL",
"queue_sharable_mem": "4072",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "LIVE2459_VAL",
"check_key_4": "AQ$_Q_PIPROCESS_TAB_E",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "AQ$_Q_PIPROCESS_TAB_E",
"queue_owner": "LIVE2459_VAL",
"queue_sharable_mem": "4072",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "SYS",
"check_key_4": "ALERT_QUE",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "ALERT_QUE",
"queue_owner": "SYS",
"queue_sharable_mem": "0",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "SYS",
"check_key_4": "AQ$_ALERT_QT_E",
"check_key_5": "",
"check_key_6": "",
"check_name": "queue_mem_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"queue_name": "AQ$_ALERT_QT_E",
"queue_owner": "SYS",
"queue_sharable_mem": "0",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "fra_check",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"flash_in_gb": "40",
"flash_reclaimable_gb": "0",
"flash_used_in_gb": ".47",
"percent_of_space_used": "1.17",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "processes",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"process_current_value": "299",
"process_limit": "1000",
"process_percent": "29.9",
"script_version": "1.0"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "sessions",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"script_version": "1.0",
"sessions_current_value": "299",
"sessions_limit": "1536",
"sessions_percent": "19.47"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "SYSTEM",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "cdb_tbs_check",
"check_status": "OK",
"current_use_mb": "1355",
"extract_date": "30/07/2024 08:09:06",
"percent_used": "2",
"script_version": "1.0",
"tablespace_name": "SYSTEM",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "SYSAUX",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "cdb_tbs_check",
"check_status": "OK",
"current_use_mb": "23635",
"extract_date": "30/07/2024 08:09:06",
"percent_used": "36",
"script_version": "1.0",
"tablespace_name": "SYSAUX",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "UNDOTBS1",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "cdb_tbs_check",
"check_status": "OK",
"current_use_mb": "22",
"extract_date": "30/07/2024 08:09:06",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "UNDOTBS1",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "USERS",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "cdb_tbs_check",
"check_status": "OK",
"current_use_mb": "4",
"extract_date": "30/07/2024 08:09:06",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "USERS",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "USERS",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "1176",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN8944",
"percent_used": "4",
"script_version": "1.0",
"tablespace_name": "USERS",
"total_physical_all_mb": "32767"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "SYSTEM",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "784",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "1",
"script_version": "1.0",
"tablespace_name": "SYSTEM",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "SYSAUX",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "1549",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN8944",
"percent_used": "2",
"script_version": "1.0",
"tablespace_name": "SYSAUX",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "USERS",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "1149",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "2",
"script_version": "1.0",
"tablespace_name": "USERS",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "UNDOTBS1",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "60",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN8944",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "UNDOTBS1",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "SYSAUX",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "7803",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "12",
"script_version": "1.0",
"tablespace_name": "SYSAUX",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "SYSTEM",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "705",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN8944",
"percent_used": "1",
"script_version": "1.0",
"tablespace_name": "SYSTEM",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN8944",
"check_key_3": "INDX",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "378",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN8944",
"percent_used": "1",
"script_version": "1.0",
"tablespace_name": "INDX",
"total_physical_all_mb": "32767"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN2467",
"check_key_3": "SYSTEM",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "623",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN2467",
"percent_used": "1",
"script_version": "1.0",
"tablespace_name": "SYSTEM",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "AUDIT_TBS",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "3",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "AUDIT_TBS",
"total_physical_all_mb": "8192"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "USRINDEX",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "128",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "USRINDEX",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "UNDOTBS1",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "77",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "UNDOTBS1",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1S48633",
"check_key_3": "TOOLS",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "5",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1S48633",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "TOOLS",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN2467",
"check_key_3": "UNDOTBS1",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "24",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN2467",
"percent_used": "0",
"script_version": "1.0",
"tablespace_name": "UNDOTBS1",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "O1NN2467",
"check_key_3": "SYSAUX",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "pdb_tbs_check",
"check_status": "OK",
"current_use_mb": "628",
"extract_date": "30/07/2024 08:09:06",
"pdb_name": "O1NN2467",
"percent_used": "1",
"script_version": "1.0",
"tablespace_name": "SYSAUX",
"total_physical_all_mb": "65536"
},
{
"check_error": "",
"check_key_1": "C2N48617",
"check_key_2": "",
"check_key_3": "",
"check_key_4": "",
"check_key_5": "",
"check_key_6": "",
"check_name": "monitoring_package",
"check_status": "OK",
"extract_date": "30/07/2024 08:09:06",
"script_version": "1.0"
}
]