Getting Data In

Multiple json events coming as one

khalid7assan
New Member

I have multiple events which are coming as one
and I need to separate them into separate events in order to create a table and etc
Is there a way to do it in the search time?
{
"Timestamp": "2020-02-08T15:45:00.036Z",
"Query Parameters": "",
"RequestMethod": "POST",
"Request": "{tt}",
"Response": "{tt}",
"HTTPStatusCode": "200",
"TotalResponseTimeApprox.(ms)": "290.0",
"TargetResponseTime(ms)": "241.0"
}{
"Timestamp": "2020-02-08T15:45:00.334Z",
"Query Parameters": "",
"RequestMethod": "POST",
"Request": "{tt}",
"Response": "{tt}",
"HTTPStatusCode": "200",
"TotalResponseTimeApprox.(ms)": "290.0",
"TargetResponseTime(ms)": "241.0"
}

Thank you

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Hi @khalid7assan,

Your event can be parsed with the following SPL:

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw

You can replicate the behaviour by copying and pasting the following code in Splunk:

| makeresults
| eval _raw = "
    {
    \"Timestamp\": \"2020-02-08T15:45:00.036Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }{
    \"Timestamp\": \"2020-02-08T15:45:00.334Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }
"

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw
| fields - _raw, _time

Output:

alt text

If you find any issues or your events are more complex than the one you included in your question, please post some more examples so that we can take a look.

Regards,
J

View solution in original post

0 Karma

javiergn
Super Champion

Hi @khalid7assan,

Did any of the answers below help with your problem? If so please don't forget to accept one so that other users can benefit from this answer in the future.

Thanks,
J

0 Karma

to4kawa
Ultra Champion

props.conf

[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER =(^){

make appropriate props.conf

0 Karma

javiergn
Super Champion

Hi @khalid7assan,

Your event can be parsed with the following SPL:

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw

You can replicate the behaviour by copying and pasting the following code in Splunk:

| makeresults
| eval _raw = "
    {
    \"Timestamp\": \"2020-02-08T15:45:00.036Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }{
    \"Timestamp\": \"2020-02-08T15:45:00.334Z\",
    \"Query Parameters\": \"\",
    \"RequestMethod\": \"POST\",
    \"Request\": \"{tt}\",
    \"Response\": \"{tt}\",
    \"HTTPStatusCode\": \"200\",
    \"TotalResponseTimeApprox.(ms)\": \"290.0\",
    \"TargetResponseTime(ms)\": \"241.0\"
    }
"

| rex field=_raw max_match=0 "(?ms)(?<split_raw>\{.+?\})(?=\{|\s*$)"
| mvexpand split_raw
| fields - _raw, _time

Output:

alt text

If you find any issues or your events are more complex than the one you included in your question, please post some more examples so that we can take a look.

Regards,
J

0 Karma

khalid7assan
New Member

Thank you it worked

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...