Hello all! I'm trying to break this huge JSON string into multiple events into Splunk. For some reason, my props.conf configs aren't working. It returns the entire large JSON string.
Props.conf:
[locu_philly]
KV_Mode = json
LINE_BREAKER = \{(.*?)\},
NO_BINARY_CHECK = 1
Truncate = 0
SHOULD_LINEMERGER = false
JSON Sample:
{u'name': u'Steaks on South', u'locality': u'Philadelphia', u'website_url': u'http://www.steaksonsouth.com/', u'cuisines': [], u'region': u'PA', u'long': -75.148055, u'phone': u'(215) 922-7880', u'postal_code': u'19147', u'categories': [u'restaurant'], u'has_menu': True, u'country': u'United States', u'lat': 39.941416, u'id': u'000923d517a59ae48e8a', u'street_address': u'308 South St.', u'resource_uri': u'/v1_0/venue/000923d517a59ae48e8a/'}, {u'name': u'Olive Branch', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.171997, u'phone': u'(215) 636-0804', u'postal_code': None, u'categories': [u'other', u'restaurant'], u'has_menu': False, u'country': u'United States', u'lat': 39.952499, u'id': u'00099e85007bf6290dc6', u'street_address': u'38 S. 19th St.', u'resource_uri': u'/v1_0/venue/00099e85007bf6290dc6/'}, {u'name': u'New China Court', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.1948377868302, u'phone': u'(215) 247-1708', u'postal_code': u'19118', u'categories': [u'restaurant'], u'has_menu': False, u'country': u'United States', u'lat': 40.0733706492276, u'id': u'00133feee8816eb4425e', u'street_address': u'7700 Crittenden St.', u'resource_uri': u'/v1_0/venue/00133feee8816eb4425e/'}, {u'name': u'K Laundromat', u'locality': u'Philadelphia', u'website_url': None, u'cuisines': [], u'region': u'PA', u'long': -75.131135, u'phone': u'(215) 324-4232', u'postal_code': u'19140', u'categories': [u'other', u'laundry'], u'has_menu': False, u'country': u'United States', u'lat': 40.014534, u'id': u'001743eaf1595d4b6b8a', u'street_address': u'4201 Rising Sun Ave.', u'resource_uri': u'/v1_0/venue/001743eaf1595d4b6b8a/'}
