Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Getting Data In
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk cannot correctly parse and ingest json even...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk cannot correctly parse and ingest json event data
hunters_splunk
Splunk Employee
05-30-2016
10:56 AM
Splunk cannot correctly parse and ingest the following json event data. I have tried all the line break settings but no luck. Thanks in advance for the help.
{
"batchcomplete": "",
"continue": {
"lecontinue": "20160516100036|18",
"continue": "-||"
},
"query": {
"logevents": [
{
"logid": 28,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 29,
"previd": 28,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:48:51Z",
"comment": ""
},
{
"logid": 27,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 28,
"previd": 25,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:47:30Z",
"comment": ""
},
{
"logid": 26,
"ns": 10,
"title": "Template:Thank You",
"pageid": 12,
"logpage": 12,
"params": {
"curid": 27,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-17T13:45:04Z",
"comment": ""
},
{
"logid": 25,
"ns": 0,
"title": "Wikitext/Table",
"pageid": 11,
"logpage": 7,
"params": {
"target_ns": 0,
"target_title": "Wikitext"
},
"type": "move",
"action": "move_redir",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:38:06Z",
"comment": ""
},
{
"logid": 24,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"target_ns": 0,
"target_title": "Wikitext/Table"
},
"type": "move",
"action": "move",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:37:49Z",
"comment": ""
},
{
"logid": 23,
"ns": 0,
"title": "Wikitext/Tables",
"pageid": 9,
"logpage": 9,
"params": {
"curid": 22,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:31:36Z",
"comment": ""
},
{
"logid": 22,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 21,
"previd": 19,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:18:38Z",
"comment": ""
},
{
"logid": 21,
"ns": 10,
"title": "Template:Test",
"pageid": 0,
"logpage": 8,
"params": {},
"type": "delete",
"action": "delete",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:16:40Z",
"comment": "content was: \"test\" (and the only contributor was \"[[Special:Contributions/JohnDoe|JohnDoe]]\")"
},
{
"logid": 20,
"ns": 10,
"title": "Template:Test",
"pageid": 0,
"logpage": 8,
"params": {
"curid": 20,
"previd": 0,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:15:13Z",
"comment": ""
},
{
"logid": 19,
"ns": 0,
"title": "Wikitext",
"pageid": 7,
"logpage": 7,
"params": {
"curid": 19,
"previd": 18,
"auto": ""
},
"type": "patrol",
"action": "patrol",
"user": "JohnDoe",
"timestamp": "2016-05-16T10:14:55Z",
"comment": ""
}
]
}
}
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
woodcock
Esteemed Legend
05-31-2016
05:43 AM
Just pass it as-is to spath, like this:
|noop|stats count as _raw| eval _raw="{
\"batchcomplete\": \"\",
\"continue\": {
\"lecontinue\": \"20160516100036|18\",
\"continue\": \"-||\"
},
\"query\": {
\"logevents\": [
{
\"logid\": 28,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 29,
\"previd\": 28,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:48:51Z\",
\"comment\": \"\"
},
{
\"logid\": 27,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 28,
\"previd\": 25,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:47:30Z\",
\"comment\": \"\"
},
{
\"logid\": 26,
\"ns\": 10,
\"title\": \"Template:Thank You\",
\"pageid\": 12,
\"logpage\": 12,
\"params\": {
\"curid\": 27,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-17T13:45:04Z\",
\"comment\": \"\"
},
{
\"logid\": 25,
\"ns\": 0,
\"title\": \"Wikitext/Table\",
\"pageid\": 11,
\"logpage\": 7,
\"params\": {
\"target_ns\": 0,
\"target_title\": \"Wikitext\"
},
\"type\": \"move\",
\"action\": \"move_redir\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:38:06Z\",
\"comment\": \"\"
},
{
\"logid\": 24,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"target_ns\": 0,
\"target_title\": \"Wikitext/Table\"
},
\"type\": \"move\",
\"action\": \"move\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:37:49Z\",
\"comment\": \"\"
},
{
\"logid\": 23,
\"ns\": 0,
\"title\": \"Wikitext/Tables\",
\"pageid\": 9,
\"logpage\": 9,
\"params\": {
\"curid\": 22,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:31:36Z\",
\"comment\": \"\"
},
{
\"logid\": 22,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 21,
\"previd\": 19,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:18:38Z\",
\"comment\": \"\"
},
{
\"logid\": 21,
\"ns\": 10,
\"title\": \"Template:Test\",
\"pageid\": 0,
\"logpage\": 8,
\"params\": {},
\"type\": \"delete\",
\"action\": \"delete\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:16:40Z\",
\"comment\": \"content was: \\\"test\\\" (and the only contributor was \\\"[[Special:Contributions/JohnDoe|JohnDoe]]\\\")\"
},
{
\"logid\": 20,
\"ns\": 10,
\"title\": \"Template:Test\",
\"pageid\": 0,
\"logpage\": 8,
\"params\": {
\"curid\": 20,
\"previd\": 0,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:15:13Z\",
\"comment\": \"\"
},
{
\"logid\": 19,
\"ns\": 0,
\"title\": \"Wikitext\",
\"pageid\": 7,
\"logpage\": 7,
\"params\": {
\"curid\": 19,
\"previd\": 18,
\"auto\": \"\"
},
\"type\": \"patrol\",
\"action\": \"patrol\",
\"user\": \"JohnDoe\",
\"timestamp\": \"2016-05-16T10:14:55Z\",
\"comment\": \"\"
}
]
}
}"
|spath
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ryanoconnor
Builder
05-30-2016
04:17 PM
This looks like valid JSON according to http://jsonlint.com/
Have you tried setting up a props.conf file with the following:
[your_sourcetype_name_here]
KV_MODE = json
Get Updates on the Splunk Community!
Index This | What is broken 80% of the time by February?
December 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this ...
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
Hello Splunk Community,
We're thrilled to share an exciting update that will help you manage your data more ...
Splunk MCP & Agentic AI: Machine Data Without Limits
Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...
