Getting Data In

Why do I have several JSON events showing as a single Splunk event?

moorvogi
Path Finder

I have 1-40 (or more) JSON objects that are seen as one event within Splunk. Each JSON object ends w/ the "}" character and is a valid JSON object. For whatever reason, there are just several JSON objects per one Splunk event.

How do i split this so it's one JSON entry per Splunk event?

Tags (2)
0 Karma

pruthvikrishnap
Contributor

Hi ,
There are multiple ways you can split the JSON events, you can try adding sedcmd to props.conf somnething like this.
[myJSON]
SEDCMD-remove_header = s/^(?:.\n){1,3}//g
SEDCMD-remove_footer = s/][\r\n]\s
}.$//g
LINE_BREAKER = }(\s
,[\r\n]\s*){`

else you can update a responsehandler which is a python class and use it in your inputs.
https://answers.splunk.com/answers/233620/how-to-use-custom-response-handlers-for-monitoring-1.html

i am not sure on what your scenario is

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...