Splunk cannot correctly parse and ingest the following json event data. I have tried all the line break settings but no luck. Thanks in advance for the help.
{
"batchcomplete": "",
"continue": {
"lecontinue": "20160516100036|18",
"continue": "-||"
},
"query": {
"logevents": [
{
"logid": 28,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 29,
"previd": 28,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:48:51Z",
"comment": ""
},
{
"logid": 27,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 28,
"previd": 25,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:47:30Z",
"comment": ""
},
{
"logid": 26,
"ns": 10,
"title": "Template:Thank You",
"pageid": 12,
"logpage": 12,
"params": {
"curid": 27,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:45:04Z",
"comment": ""
},
{
"logid": 25,
"ns": 0,
"title": "Wikitext/Table",
"pageid": 11,
"logpage": 7,
"params": {
"target_ns": 0,
"target_title": "Wikitext"
},
"type": "move",
"action": "move_redir",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:38:06Z",
"comment": ""
},
{
"logid": 24,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"target_ns": 0,
"target_title": "Wikitext/Table"
},
"type": "move",
"action": "move",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:37:49Z",
"comment": ""
},
{
"logid": 23,
"ns": 0,
"title": "Wikitext/Tables",
"pageid": 9,
"logpage": 9,
"params": {
"curid": 22,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:31:36Z",
"comment": ""
},
{
"logid": 22,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 21,
"previd": 19,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:18:38Z",
"comment": ""
},
{
"logid": 21,
"ns": 10,
"title": "Template:Test",
"pageid": 0,
"logpage": 8,
"params": {},
"type": "delete",
"action": "delete",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:16:40Z",
"comment": "content was: \"test\" (and the only contributor was \"[[Special:Contributions/JohnDoe|JohnDoe]]\")"
},
{
"logid": 20,
"ns": 10,
"title": "Template:Test",
"pageid": 0,
"logpage": 8,
"params": {
"curid": 20,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:15:13Z",
"comment": ""
},
{
"logid": 19,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 19,
"previd": 18,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:14:55Z",
"comment": ""
}
]
}
}
Just pass it as-is to spath
, like this:
|noop|stats count as _raw| eval _raw="{
\"batchcomplete\": \"\",
\"continue\": {
\"lecontinue\": \"20160516100036|18\",
\"continue\": \"-||\"
},
\"query\": {
\"logevents\": [
{
\"logid\": 28,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 29,
\"previd\": 28,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:48:51Z\",
\"comment\": \"\"
},
{
\"logid\": 27,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 28,
\"previd\": 25,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:47:30Z\",
\"comment\": \"\"
},
{
\"logid\": 26,
\"ns\": 10,
\"title\": \"Template:Thank You\",
\"pageid\": 12,
\"logpage\": 12,
\"params\": {
\"curid\": 27,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:45:04Z\",
\"comment\": \"\"
},
{
\"logid\": 25,
\"ns\": 0,
\"title\": \"Wikitext/Table\",
\"pageid\": 11,
\"logpage\": 7,
\"params\": {
\"target_ns\": 0,
\"target_title\": \"Wikitext\"
},
\"type\": \"move\",
\"action\": \"move_redir\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:38:06Z\",
\"comment\": \"\"
},
{
\"logid\": 24,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"target_ns\": 0,
\"target_title\": \"Wikitext/Table\"
},
\"type\": \"move\",
\"action\": \"move\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:37:49Z\",
\"comment\": \"\"
},
{
\"logid\": 23,
\"ns\": 0,
\"title\": \"Wikitext/Tables\",
\"pageid\": 9,
\"logpage\": 9,
\"params\": {
\"curid\": 22,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:31:36Z\",
\"comment\": \"\"
},
{
\"logid\": 22,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 21,
\"previd\": 19,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:18:38Z\",
\"comment\": \"\"
},
{
\"logid\": 21,
\"ns\": 10,
\"title\": \"Template:Test\",
\"pageid\": 0,
\"logpage\": 8,
\"params\": {},
\"type\": \"delete\",
\"action\": \"delete\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:16:40Z\",
\"comment\": \"content was: \\\"test\\\" (and the only contributor was \\\"[[Special:Contributions/JohnDoe|JohnDoe]]\\\")\"
},
{
\"logid\": 20,
\"ns\": 10,
\"title\": \"Template:Test\",
\"pageid\": 0,
\"logpage\": 8,
\"params\": {
\"curid\": 20,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:15:13Z\",
\"comment\": \"\"
},
{
\"logid\": 19,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 19,
\"previd\": 18,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:14:55Z\",
\"comment\": \"\"
}
]
}
}"
|spath
This looks like valid JSON according to http://jsonlint.com/
Have you tried setting up a props.conf file with the following:
[your_sourcetype_name_here]
KV_MODE = json