Splunk Cloud Platform

JSON Parsing issues

samneo
Path Finder
 
 
 
 
 
 
 

Im sending a large payload of JSON data to splunk (1000 events) over HEC but when it reaches splunk it does not split the event and thinks its just 1 large event. The JSON is valid but its to do with the first part of the JSON thats the issue. It shows as per the below:

 

 

 

{
"expand": "schema,names",
"startAt": 0,
"maxResults": 50,
"total": 1253,
"issues": [

 

 

 

If i remove this manually and then the correlating bottom brackets and send manually, all the events are parsed individually. 

 

The second problem i have is that we are on managed splunk cloud so i dont have access to props.conf to amend the line breaker. Can anyone suggest any other way round this?

 

Im using spyder python as the middle man to send the load and also testing with postman? 

Labels (1)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you modify the payload with your middleman? If not, can you use spath to extract the issues array into a multi value field and then mvexpand to separate them into different events?

0 Karma

thambisetty
Super Champion

there could be issue with event format.

————————————
If this helps, give a like below.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!