We are pulling some data from REST using REST API Modular Input (splunkbase.splunk.com/app/1546/), Response type json, and receiving the below response { "request" : "/getAllNearTermPSRT", "response" : { "now" : "2018-11-29T14:19:00Z", "flights" : [ { "AODBUniqueField" : "7274920", "flightNo" : "BA2233", "PSRTc" : "2018-11-28T14:16:00Z", "PSRT1" : "2018-11-28T14:15:00Z", "PSRT2" : "2018-11-28T14:15:00Z", "PSRT3" : "2018-11-28T14:15:00Z" }, { "AODBUniqueField" : "7274889", "flightNo" : "EZY8255", "PSRTc" : "2018-11-28T14:26:00Z", "PSRT1" : "2018-11-28T14:21:00Z", "PSRT2" : "2018-11-28T14:21:00Z", "PSRT3" : "2018-11-28T14:21:00Z" }, { "AODBUniqueField" : "7274797", "flightNo" : "EZY8474", "PSRTc" : "2018-11-28T14:24:00Z", "PSRT1" : "2018-11-28T14:26:00Z", "PSRT2" : "2018-11-28T14:25:00Z", "PSRT3" : "2018-11-28T14:25:00Z" }, { "AODBUniqueField" : "7274825", "flightNo" : "D82806", "PSRTc" : "2018-11-28T14:26:00Z", "PSRT1" : "2018-11-28T14:27:00Z", "PSRT2" : "2018-11-28T14:26:00Z", "PSRT3" : "2018-11-28T14:26:00Z" }, { "AODBUniqueField" : "7274478", "flightNo" : "MT556", "PSRTc" : "2018-11-28T15:03:00Z", "PSRT1" : "2018-11-28T14:41:00Z", "PSRT2" : "2018-11-28T15:03:00Z", "PSRT3" : "2018-11-28T15:10:00Z" }, { "AODBUniqueField" : "7274932", "flightNo" : "EI239", "PSRTc" : "2018-11-28T15:25:00Z", "PSRT1" : "2018-11-28T15:10:00Z", "PSRT2" : "2018-11-28T15:24:00Z", "PSRT3" : "2018-11-28T15:25:00Z" } ] } } We would like to split each individual flight into individual events using current time as the timestamp, however, no matter what I have tried, I can't get Splunk to break the events. We've tried multiple different BREAK options in the sourcetype, but still no luck. We either get the whole lot as one single event, or we just get two events, one saying "request" and the other "response". Is anyone able to help? ... View more