Getting Data In

line break NIST CVE json file

DanielASG
Explorer

I trying to break up the nist cve json file into each cve event

Below is a (small) output of the json file

CVE_data_numberOfCVEs" : "1691",
"CVE_data_timestamp" : "2019-03-28T00:00Z",
"CVE_Items" : [ {
"cve" : {
  "data_type" : "CVE",

I would like to line split it so it looks like this

{
"cve" : {
  "data_type" : "CVE",

But only seam to get it to split like this

  "cve" : {
  "data_type" : "CVE",

I have tried the below
Props.conf

BREAK_ONLY_BEFORE =(?m){\s+”cve”

And

BREAK_ONLY_BEFORE =\s{\s+”cve”

With no luck … I have tried lots of other ways but the two above should work (I think)

Can anyone see im doing wrong?
thanks

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...