Getting Data In

Why does a single, short json file create multiple events in Splunk?

Path Finder

I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?

alt text

I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.

0 Karma
1 Solution

Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

View solution in original post

0 Karma

Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

View solution in original post

0 Karma

Builder
0 Karma

Path Finder

I think this is a different problem.

0 Karma

Communicator

Can you post some sample data.

if you want to combine total json file in to single event Give a try using this property in props.conf

SHOULD_LINEMERGE= TRUE

0 Karma

Path Finder

This is enabled True on defaults and I don't see any thing overriding it.

0 Karma

Path Finder
0 Karma

Path Finder

above is link to the way it looks in search.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!