Getting Data In

Why does a single, short json file create multiple events in Splunk?

shawny2005
Path Finder

I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?

alt text

I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.

0 Karma
1 Solution

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

View solution in original post

0 Karma

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

0 Karma

satishsdange
Builder
0 Karma

shawny2005
Path Finder

I think this is a different problem.

0 Karma

mpreddy
Communicator

Can you post some sample data.

if you want to combine total json file in to single event Give a try using this property in props.conf

SHOULD_LINEMERGE= TRUE

0 Karma

shawny2005
Path Finder

This is enabled True on defaults and I don't see any thing overriding it.

0 Karma

shawny2005
Path Finder
0 Karma

shawny2005
Path Finder

above is link to the way it looks in search.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...