Splunk Search

Regex with Line break while pushing data into splunk

Hello Team,

Could you please help to parse this data while pushing this in source type data into splunk.

Issue is if i am adding Event Break with Regex using this }}(,)

ROW1 getting converted into JSON but ROW2 is not able to convert due to its merging data (like in Row 2 there is 2 _time )

Could anyone please help ?

Row 1
{"time":"2019-12-27T18:08:56.9035062Z","systemId":"03761897-51e8-4a4f-b1c7-01b5372fbece","macAddress":"000D3AF9BCB0","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.192-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3AF9BCB0","flowTuples":["1577470084,10.65.5.198,205.185.216"]}]}]}}

Row 2
{"time":"2019-12-27T18:09:56.9504048Z","systemId":"03761897-51e8-4a4f-b1c7-01b5372fbece","macAddress":"000D3AF9BCB0","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.192-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3AF9BCB0","flowTuples":["1577470135,10.65.5.198,23.75.194.41,59094,80,T,O,D"]}]}]}}]}
{"time":"2019-12-27T18:00:55.7627056Z","systemId":"a951027c-dc23-41a7-9973-77afcfa4bbfd","macAddress":"000D3A6D539B","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/E63B08C3-D314-48D8-B10A-C58199BB78B1/RESOURCEGROUPS/AZUR-P-1-SOSG-RG-1/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/S-10.65.5.48-28-NSG","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":1,"flows":[{"rule":"UserRule_Deny_Outbound","flows":[{"mac":"000D3A6D539B","flowTuples":["1577469594,10.65.5.53,10.65.5.68,59262,17472,T,O,D","1577469595,10.65.5.53,168.62.24.23,59254,443,T,O,D"]}]}]}}

alt text

0 Karma

SplunkTrust
SplunkTrust

Try LINE_BREAKER = ([\r\n]+){"time".

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Sorry its not working

actaully having issue of Row 2 Ending "]}]}]}} <------ This one creating issue
as in Row 1 it have ]}]}]}}

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!