Splunk Search

Regex with Line break while pushing data into splunk

mailtosnsolutio
Explorer

Hello Team,

Could you please help to parse this data while pushing this in source type data into splunk.

Issue is if i am adding Event Break with Regex using this }}(,)

ROW1 getting converted into JSON but ROW2 is not able to convert due to its merging data (like in Row 2 there is 2 _time )

Could anyone please help ?

Row 1
{"time":"2019-12-27T18:08:56.9035062Z","systemId":"03761897-51e8-4a4f-b1c7-01b5372fbece","macAddress":"000D3AF9BCB0","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.192-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3AF9BCB0","flowTuples":["1577470084,10.65.5.198,205.185.216"]}]}]}}

Row 2
{"time":"2019-12-27T18:09:56.9504048Z","systemId":"03761897-51e8-4a4f-b1c7-01b5372fbece","macAddress":"000D3AF9BCB0","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.192-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3AF9BCB0","flowTuples":["1577470135,10.65.5.198,23.75.194.41,59094,80,T,O,D"]}]}]}}]}
{"time":"2019-12-27T18:00:55.7627056Z","systemId":"a951027c-dc23-41a7-9973-77afcfa4bbfd","macAddress":"000D3A6D539B","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.48-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3A6D539B","flowTuples":["1577469594,10.65.5.53,10.65.5.68,59262,17472,T,O,D","1577469595,10.65.5.53,168.62.24.23,59254,443,T,O,D"]}]}]}}

alt text

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try LINE_BREAKER = ([\r\n]+){"time".

---
If this reply helps you, Karma would be appreciated.
0 Karma

mailtosnsolutio
Explorer

Sorry its not working

actaully having issue of Row 2 Ending "]}]}]}} <------ This one creating issue
as in Row 1 it have ]}]}]}}

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...