i am trying to upload json file using UI in Splunk cloud and applying settings for parsing as below but data is coming as a single event [custom_json_sourcetype] INDEXED_EXTRACTIONS = json SHOULD...
See more...
i am trying to upload json file using UI in Splunk cloud and applying settings for parsing as below but data is coming as a single event [custom_json_sourcetype] INDEXED_EXTRACTIONS = json SHOULD_LINEMERGE = false KV_MODE = json LINE_BREAKER = },\s*{ please advise correct settings to apply under sourcetypes in web when uploading here is the data: { "sourcetype": "testoracle_sourcetype", "data": { "cdb_tbs_check": [ { "check_error": "", "check_name": "cdb_tbs_check", "check_status": "OK", "current_use_mb": "1355", "percent_used": "2", "tablespace_name": "SYSTEM", "total_physical_all_mb": "65536" }, { "check_error": "", "check_name": "cdb_tbs_check", "check_status": "OK", "current_use_mb": "23596", "percent_used": "36", "tablespace_name": "SYSAUX", "total_physical_all_mb": "65536" }, { "check_error": "", "check_name": "cdb_tbs_check", "check_status": "OK", "current_use_mb": "29", "percent_used": "0", "tablespace_name": "UNDOTBS1", "total_physical_all_mb": "65536" },