Thanks so much for the response. This still doesn't work for me. My sample data is below. I don't really care if any of the dates are used as timestamps. Today's date as default would be fine. I just want separate events to be recognized.
{"respId":"search","status":"0","events":[{"name":"event1","startDate":"20150404:1600",...move stuff,"dateReceived":"20150405:0000"},{"name":"event2",.........}],"count":"500"}
If I use the default _json (Indexed_extractions = json) I end up with fields respId, status, events{}:name, events{}:startDate, events{}:dateReceived etc. where all the data for these fields is now crammed into the one field - i.e., one event.
My props.conf fields are
INDEXED_EXTRACTIONS = json
TIME_FORMAT = %Y%m%d:%H%M
BREAK_ONLY_BEFORE = {"name"
TIME_PREFIX = dateReceived":
... View more