Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Json Event Breaking Issues
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Folks,
Splunk Ent V6.5.2
I have a curly one here. I have a Json file ( sample below).
When the file is ingested events don't always get separated. The props is on a HF.
Thanks in advance.
I have the following props.conf.
[ ss_api2 ]
CHARSET=UTF-8
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
TIME_PREFIX=timestamp
TRUNCATE = 500000
category=custom
description=Slipstream Prod/Beta api.
disabled=false
pulldown_type=true
Json sample:
{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\r\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable1 parameters)\\r\\n at Autofac.Features.Indexed.KeyedServiceIndex2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d_10.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 186\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"e0d465f5-8a37-47de-94c0-ad77a8e83493\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configenvironments?apptype=DigitalPlatform\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4029" }1 parameters)\r\n at Autofac.Features.Indexed.KeyedServiceIndex`2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d3.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 39\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.
{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\\r\\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.
For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.
Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...
[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.
For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.
Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...
[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM
All Work and No Play? Not at .conf26! Unwind at These Evening Events
Join the Hackathon at .conf26 and build a No-Code AI agent
