Json parsing - event breaks

[Nadhiyaa]

Below is my event :

[ [-]
{ [-]
created_at: 2019-08-28T13:48:48.722Z

credibility_score: -5
email: [email protected]

id: 625

last_reported_at: 2019-08-28T13:52:48.000Z

reports_count: 1

updated_at: 2019-08-28T13:48:51.519Z

vip: false

}

{ [-]
created_at: 2019-08-28T04:46:22.106Z

credibility_score: 0

email: [email protected]

id: 624

last_reported_at: 2019-08-28T04:48:36.000Z

reports_count: 1

updated_at: 2019-08-28T04:46:24.169Z

vip: false

}

{ [-]
created_at: 2019-08-25T03:50:59.412Z

credibility_score: -5
email: [email protected]

id: 623

last_reported_at: 2019-08-26T15:14:33.000Z

reports_count: 2

updated_at: 2019-08-26T15:10:40.260Z

vip: false

}
}

i want to break every single event , taking timestamp of my last_reported_at field .

Below is my props.conf

[xxx]
SHOULD_LINEMERGE = false
category = Splunk App Add-on Builder
pulldown_type = 1
KV_MODE = json
NO_BINARY_CHECK = true
TRUNCATE = 0
TIME_PREFIX = "last_reported_at":"

Please correct whats wrong with my props.conf

[jrballesteros05]

I had an experience similar to you and I finally had to modify the script who generates the json to avoid using arrays. I mean json like this:

[
{ [-]
created_at: 2019-08-28T13:48:48.722Z
credibility_score: -5
email: [email protected]
id: 625
last_reported_at: 2019-08-28T13:52:48.000Z
reports_count: 1
updated_at: 2019-08-28T13:48:51.519Z
vip: false
}
{ [-]
created_at: 2019-08-28T04:46:22.106Z
credibility_score: 0
email: [email protected]
id: 624
last_reported_at: 2019-08-28T04:48:36.000Z
reports_count: 1
updated_at: 2019-08-28T04:46:24.169Z
vip: false
} 
]

It did not work for me. I had to remove the array and had json like this:

{ [-]
created_at: 2019-08-28T13:48:48.722Z
credibility_score: -5
email: [email protected]
id: 625
last_reported_at: 2019-08-28T13:52:48.000Z
reports_count: 1
updated_at: 2019-08-28T13:48:51.519Z
vip: false
}
{ [-]
created_at: 2019-08-28T04:46:22.106Z
credibility_score: 0
email: [email protected]
id: 624
last_reported_at: 2019-08-28T04:48:36.000Z
reports_count: 1
updated_at: 2019-08-28T04:46:24.169Z
vip: false
} 

The the sourcetype _json worked perfectly.

[riqbal47010]

so please accept my answer.

[Nadhiyaa]

hi @riqbal47010 yes it worked . but when i give table command the values are coming double .How can i resolve that

[riqbal47010]

please define the source type as

sourcetype = _json

[Nadhiyaa]

hi if i define sourcetype=_json , it gets only the first event { [-]
created_at: 2019-08-28T13:48:48.722Z
credibility_score: -5
email: [email protected]
id: 625
last_reported_at: 2019-08-28T13:52:48.000Z
reports_count: 1
updated_at: 2019-08-28T13:48:51.519Z
vip: false
}

[kamlesh_vaghela]

@Nadhiyaa

Can you please share sample event in the code block.

like event

OR

event

[Nadhiyaa]

[ [-] 
{ [-] 
created_at: 2019-08-28T13:48:48.722Z 
credibility_score: -5 
email: [email protected] 
id: 625 
last_reported_at: 2019-08-28T13:52:48.000Z 
reports_count: 1 
updated_at: 2019-08-28T13:48:51.519Z 
vip: false 
} 
{ [-] 
created_at: 2019-08-28T04:46:22.106Z 
credibility_score: 0 
email: [email protected] 
id: 624 
last_reported_at: 2019-08-28T04:48:36.000Z 
reports_count: 1 
updated_at: 2019-08-28T04:46:24.169Z 
vip: false 
} 
{ [-] 
created_at: 2019-08-25T03:50:59.412Z 
credibility_score: -5 
email: [email protected] 
id: 623 
last_reported_at: 2019-08-26T15:14:33.000Z 
reports_count: 2 
updated_at: 2019-08-26T15:10:40.260Z 
vip: false 
}
}