Hi Team, We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object ...
See more...
Hi Team, We are trying to extract JSON data with custom sourcetype and With the current configuration, all JSON objects are being combined into a single event in Splunk. Ideally, each JSON object should be recognized as a separate event, but the configuration is not breaking them apart as expected
I observed that each JSON object has a comma after the closing brace }, which appears to be causing the issue by preventing Splunk from treating each JSON object as a separate event.
sample data :
{
"timestamp":"1727962122",
"phonenumber": "0000000"
"appname": "cisco"
},
{
"timestamp":"1727962123",
"phonenumber": "0000000"
"appname": "windows"
},
Error message : Error message : JSON StreamID:0 had parsing error: Unexpected character while looking for value comma ','
Thanks in advance