This is also an issue, having a non-completed JSON output is not ideal for an API call. I ended up having to write up some code to wrap around this issue, so we could consume it. I have posted the python3 code here - so you can consume it if you have a similar issue, i had created a script to wrap around the lack of ability that SPLUNK offers in this simple requirement. import json from collections import defaultdict class GetDetailsForEmail(): def init(self): self.load = self.setup_details('file.json') def setup_details(self, filename): data = open(filename).read() count = data.count("}}") - 1 data = data.replace("}}", "}},", count) data = data.replace("}}\n", "}}]\n") data = data.replace('{', '[{', 1) newdata = json.loads(data) ... View more

I also agree with this, it is broken if its not a proper JSON payload. It needs a simple array around it and make it , delimeted per json row. I ended up fixing this in my python - i have attached the fix below : !/bin/python3.6 import json from collections import defaultdict class GetDetails(): def init(self): self.load = self.setup_details('file.json') def setup_details(self, filename): data = open(filename).read() count = data.count("}}") - 1 data = data.replace("}}", "}},", count) data = data.replace("}}\n", "}}]\n") data = data.replace('{', '[{', 1) newdata = json.loads(data) Then you can use in another def to run through the actuals, not ideal SPLUNK to have a bad json format. ... View more