I have a json file like below, i need to broke it up in to events
{"env":"UAT","label":"jenkins-17887.api.v2.dm.btc","App":"dm-d-services","rlmtemplate":"f2_api_fed","lastupdate":2020-11-23 11:09:78:455,"region":"APAC"},{"env":"UAT","label":"jenkins-17687.api.v2.dm.btc","App":"dt-s-services","rlmtemplate":"f3_api_fed","lastupdate":2020-11-23 11:025:79:475,"region":"APAC"},{"env":"UAT","label":"jenkins-18657.api.v2.dm.btc","App":"dt-s-services","rlmtemplate":"f3_api_fed","lastupdate":2020-11-23 11:025:79:475,"region":"APAC"},{"env":"UAT","label":"jenkins-17637.api.v2.dm.btc","App":"dt-s-services","rlmtemplate":"f3_api_fed","lastupdate":2020-11-23 11:025:79:475,"region":"APAC"}
I'm trying to forward it to splunk
modified props.conf file like below
[test_json]
INDEXED_EXTRACTIONS = JSON
LINEBREAKER = }(,){"env":
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
TRUNCATE = 0
TZ = Asia/Singapore
But only getting first line of json as event , remaining data is not coming to splunk.
==Firstline ==
"env":"UAT","label":"jenkins-17887.api.v2.dm.btc","App":"dm-d-services","rlmtemplate":"f2_api_fed","lastupdate":2020-11-23 11:09:78:455,"region":"APAC"
Can any one suggest what's going wrong.
Thank you all, it's working for me after removing comma's using sed command.
Thank you all, it's working for me after removing comma's using sed command.
Hi. What simplified things for me was to ask the people creating logs not to have the trailing comma. So the logs look like this
{"timestamp": "2020-11-25 08:59:24 UTC", "hostname": "foo.com", "status": "failed"}
{"timestamp": "2020-11-25 08:59:29 UTC", "hostname": "bar.com", "status": "passed"}
Props are
[my_sourcetype]
INDEXED_EXTRACTIONS = JSON
KV_MODE = none
SHOULD_LINEMERGE=false
TIME_PREFIX = timestamp\":\s*\"
TIME_FORMAT=%Y-%m-%d %H:%M:%S %Z
MAX_TIMESTAMP_LOOKAHEAD=23
TRUNCATE=99999
"LINEBREAKER" should be "LINE_BREAKER". The props must be installed on the first heavy forwarder or indexer the events pass through. Don't forget to restart Splunk after modifying props.conf.
@richgalloway I have used LINE_BREAKER , and props is installed on indexer. Still not working.
[test_json]
DATETIME_CONFIG =
KV_MODE = json
LINE_BREAKER = (,){
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %F %H:%M
TIME_PREFIX = lastupdate\":
indexed_extractions can't work.
@to4kawa Modified props but it's giving single event without breaking json