Getting Data In

Why does a single, short json file create multiple events in Splunk?

shawny2005
Path Finder

I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?

alt text

I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.

0 Karma
1 Solution

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

View solution in original post

0 Karma

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

0 Karma

satishsdange
Builder
0 Karma

shawny2005
Path Finder

I think this is a different problem.

0 Karma

mpreddy
Communicator

Can you post some sample data.

if you want to combine total json file in to single event Give a try using this property in props.conf

SHOULD_LINEMERGE= TRUE

0 Karma

shawny2005
Path Finder

This is enabled True on defaults and I don't see any thing overriding it.

0 Karma

shawny2005
Path Finder
0 Karma

shawny2005
Path Finder

above is link to the way it looks in search.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...