Hello Splunkers, I'm facing problem with correct parsing json data. Splunk correctly recognizes data as json sourced, but with default settings, it cannot parse data correctly. It creates fields lik...
See more...
Hello Splunkers, I'm facing problem with correct parsing json data. Splunk correctly recognizes data as json sourced, but with default settings, it cannot parse data correctly. It creates fields like: 3b629fbf-be6c-4806-8ceb-1e2b196b6277.currentUtilisation or device31.1.127.out::device54.1.87.in.currentUtilisation. As the main field is irregular I don't know how to set line_breaker which is the most likely main cause of the problem. Can I count on your help? A chunk of the input file is below. {
"device31.1.127.out::device54.1.87.in": {
"currentUtilisation": 0.0,
"enabled": true,
"from": "device31.1.127.out",
"hasBookings": false,
"id": "device31.1.127.out::device54.1.87.in",
"isActive": false,
"name": "Adam",
"props": {
"bandwidth": 90000.0,
"conflictPri": 1,
"description": ""
},
"to": "device54.1.87.in",
"usage": {
"bookings": [],
"id": "device31.1.127.out::device54.1.87.in"
}
},
"device49.1.117.out::device34.1.69.in": {
"currentUtilisation": 0.0,
"enabled": true,
"from": "device49.1.117.out",
"hasBookings": false,
"id": "device49.1.117.out::device34.1.69.in",
"isActive": false,
"name": "Barek",
"props": {
"bandwidth": 90000.0,
"conflictPri": 1,
"description": ""
},
"to": "device34.1.69.in",
"usage": {
"bookings": [],
"id": "device49.1.117.out::device34.1.69.in"
}
},
"3b629fbf-be6c-4806-8ceb-1e2b196b6277": {
"currentUtilisation": 0.0,
"enabled": true,
"from": "device38.1.93.out",
"hasBookings": false,
"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277",
"isActive": false,
"name": "Cezary",
"props": {
"bandwidth": 90000.0,
"conflictPri": 1,
"description": ""
},
"to": "device441.1.89.in",
"usage": {
"bookings": [],
"id": "3b629fbf-be6c-4806-8ceb-1e2b196b6277"
}
},
"87725874-f760-4e37-9421-168506a05573": {
"currentUtilisation": 0.0,
"enabled": true,
"from": "device21.1.75.out",
"hasBookings": false,
"id": "87725874-f760-4e37-9421-168506a05573",
"isActive": false,
"name": "Darek",
"props": {
"bandwidth": 90000.0,
"conflictPri": 1,
"description": ""
},
"to": "device61.1.97.in",
"usage": {
"bookings": [],
"id": "87725874-f760-4e37-9421-168506a05573"
}
}
}