I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?
I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.
Can you post some sample data.
if you want to combine total json file in to single event Give a try using this property in props.conf
I managed to solve it by, renaming the first element of the .json file. it was "comments": ""
that seems to have broken the parser for some reason. The first element was a "". Not sure why.