Getting Data In

Json Event Breaking Issues

NickLaurent
New Member

Hi Folks,

Splunk Ent V6.5.2

I have a curly one here. I have a Json file ( sample below).
When the file is ingested events don't always get separated. The props is on a HF.

Thanks in advance.

I have the following props.conf.

[ ss_api2 ]
CHARSET=UTF-8
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
TIME_PREFIX=timestamp
TRUNCATE = 500000
category=custom
description=Slipstream Prod/Beta api.
disabled=false
pulldown_type=true

Json sample:

{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\r\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable1 parameters)\\r\\n at Autofac.Features.Indexed.KeyedServiceIndex2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d_10.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 186\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.d2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.d0.MoveNext() MS_LoggedBy: System.Collections.Generic.List1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"e0d465f5-8a37-47de-94c0-ad77a8e83493\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configenvironments?apptype=DigitalPlatform\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4029" }
{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\\r\\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable
1 parameters)\r\n at Autofac.Features.Indexed.KeyedServiceIndex`2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d
3.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 39\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.d2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.d_0.MoveNext() MS_LoggedBy: System.Collections.Generic.List`1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"46bee1fe-04af-40f0-97ba-1a4954f87bdd\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configscopes?apptype=DigitalPlatform&scopetype=shared\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4149" }

0 Karma
1 Solution

maciep
Champion

You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.

For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.

Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...

[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25

View solution in original post

0 Karma

maciep
Champion

You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.

For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.

Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...

[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...