About burras

burras · ‎02-06-2019

If you have separate hot/cold storage paths, I assume you would need to run this test multiple times with a different "directory" setting for each?

burras · ‎03-30-2018

Thanks - using list fixed up the issue. Appreciate the help!

burras · ‎03-28-2018

I have an existing data set that provides a dump of multiple data points in a single event. The data set looks something like this: HOSTNAME = "NODE1" License Type: MAIN INSTALLED.Count: 1 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 0 License Type: TRANSRATE INSTALLED.Count: 12 Mainboard: 0 I/O 1: 0 MFP 2: 0 Total Licenses in Use: 9 License Type: EXTENSION is NOT INSTALLED And the data set continues with about 50 more license types per node. I've been able to set up extraction of various fields (node, license_type, license_avail, license_used) using props.conf and transforms.conf: props.conf [license] EXTRACT-hostname = HOSTNAME=\"(?<node>\w+)\" REPORT-license_type = license_type REPORT-license_available = license_available REPORT-license_used = license_used transforms.conf [license_type] REGEX = License\sType:\s(?<license_type>\w+)\sINSTALLED\.Count FORMAT = license_type::$1 MV_ADD = true [license_available] REGEX = INSTALLED\.Count\s(?<license_avail>\d+)\s+ FORMAT = license_avail::$1 MV_ADD = true [license_used] REGEX = \s+Total\sLicenses\sin\sUse:\s(?<license_used>\d+) FORMAT = license_used::$1 MV_ADD = true These seem to be working fine - I'm able to extract and see a list of all of the available licenses on the system (i.e. MAIN, TRANSRATE); the count of all available licenses (i.e. 1, 12), and the count of licenses actually in use (i.e. 0, 9). The problem I'm having is correlating this data together in an actual report for the users. I can't seem to make the numbers line up properly. I've tried numerous stats, charts, and other commands, but can't seem to make it line up into what should be a fairly simple report - For each node, list installed license types with a count of licenses available and licenses in use: Host Type Available Used NODE1 MAIN 1 0 NODE1 TRANSRATE 12 9 What I've ended up with is usually the same values for each license type or a completely unordered list with no correlation between the counts and the license type. Some of the searches I've used are: |stats values(license_type) values(license_avail) values(license_used) by node - returns uncorrelated list of numbers |stats latest(license_type) latest(license_avail) latest(license_used) by node - returns visually what I'm looking for but only 1 license type per node I'm sure there's something pretty simple that I'm missing here but I appreciate any help...

burras · ‎10-24-2017

Thanks - knowing that there weren't any options out there to do it directly in Splunk I ended up cobbling together a gawk script that was able to convert the output to a tilde-separated field.

burras · ‎10-23-2017

This is currently not supported. An enhancement request has been submitted to Support.

burras · ‎10-23-2017

After some additional research and discussion with the Support teams: VIP is the way to go. There is no need to add each individual cluster member separately.

burras · ‎10-23-2017

We are currently using the outputcsv command to generate a report for one of our support teams. Overall it works great but they did have one request - currently only fields that have a special character in them get included in double quotes; all other fields are simply comma separated. To make life easier on that time we'd like to accomplish one of two goals: 1) have all fields included in double quotes, or 2) be able to output in a structured format other than CSV such as PSV or tilde-separated (their choice, not mine). Our overall search is pretty standard - it's just a standard listing of output fields: |table field1 field2 field3 ... field X Any help is greatly appreciated!

burras · ‎10-16-2017

In this particular case K actually does equate to thousands while M equates to millions - not necessary kilo and mega. 21.7K should value out to 21700 while 2.11M should value out to 2110000. We don't see any values higher than an M ever. I adjusted the M to multiply by 1000000 and that fixed the problem. Thanks for all your help with this and I'll definitely be able to apply to my others use cases!

burras · ‎10-16-2017

Adding the true() statement definitely seems to fix the no suffix issue. However, I'm still seeing invalid results when the suffix if "M". I hate not being able to upload images from work - it would make this a lot easier. Using the eval statement provided above and an event of: Network Congestion 2.11M 29.2K 27.4K 27.4K 27.4K 27.5K 37.4K I get the following results: Congestion 21100 network_congestion 2.11M With the same eval statement and a data set of: Network Congestion 21.7K 8531 8699 8755 8602 9862 0 0 0 0 I get the following results: Congestion 21700 network_congestion 21.7K

burras · ‎10-11-2017

I also noticed that while it works for values of "K", it does not appear to work for values of "M". We just had one come in that was congestion=2.05M and the dataInt field value ended up as 20500 which would mean it's being captured by the "K" case.

burras · ‎10-11-2017

Thanks niketnilay - I ran with this and it looks like it's creating a new field called dataInt that has the new values in it. However, I noticed that any original values that didn't contain one of the alphanumeric identifiers are completely excluded (i.e. cases where congest=0 or any other value under 10K). Is there a way to add another statement to the case where if it doesn't match any of those you just multiply by 1?

burras · ‎10-11-2017

Also of note, the values will not always have a "K" in them. We do see events that come in like this: Congestion 0 55.3K 1836 40.2K 39.9K 38.9K 40.9K Whatever solution is devised needs to be able to account for situations where the "K" is not present - I tried the convert memk() command but it didn't handle the entries that didn't have the "K" properly (didn't convert them to K base units).

burras · ‎10-11-2017

We've already extracted the value out into a field that contains the alpha identifier (i.e. congestion=39.6K). The line included above is part of a much larger event - but it will always look like the above and will only ever have a single value (no mv fields for this one).

burras · ‎10-11-2017

I've seen numerous questions out there that touch on this topic but haven't found an answer that actually meets my specific use case. I have data from several sources that report numeric data (such as bandwidth or other datatypes) but instead of returning the value as a number (such as 39600) it returns in this format: 39.6K. I'm able to ingest those values but Splunk, unsurprisingly, doesn't know how to handle that - it treats it as text instead of a number. Long story short, I need a way to translate the following data points into numeric values, either at ingest time or at search time: Congestion 39.6K 55.3K 41.2K 40.2K 39.9K 38.9K 40.9K We only need to return the first value after "Congestion" - the 39.6K value. The other values are previous poll results and we're collecting that already. The output should end up looking like: Congestion 39600 This specific data set should never go above "K", but I have other datasets that might go into M or G, etc., so I need something as flexible as possible. I've tried using rex and sed but I've not had any success yet with it. If anyone can provide any help, it'd be greatly appreciated as it will solve multiple issues for us...

burras · ‎07-28-2017

We successfully got the app and add-on for this product installed. The only question I had was whether we should be adding individual filers, the cluster VIPs, or both to the OnTap Collection Configuration interface. The documentation I've found doesn't seem to have a lot of information on that. Any thoughts would be greatly appreciated!

burras · ‎07-10-2017

I checked the job inspector and I see that it definitely looks like it's hitting all of the servers - I see the remoteSearchLogs for all of the appropriate systems and invocation counts look accurate and expected. The resultCount in the inspector shows 235 (which is pretty accurate) - it just only shows results of 100 in the display.

burras · ‎07-10-2017

Our current Splunk deployment is around 300 servers. We have all of those systems in our DMC and our able to get data from them successfully. However, when running the Health Checks it only ever checks 100 systems, not the full spectrum of our systems. Is there a way to change the Health Checks so that they'll work on any number of Splunk instances that meet the DMC group requirements instead of limiting it to 100? The primary check I've been working with is the Assessment of Server ulimits since that checks all servers globally. I've checked through some of the searches in the health checks and can't find anything there that specifically limits them to 100. We're currently running 6.6.1 on the DMC and the other Splunk instances.

burras · ‎04-07-2017

I mentioned this in my other comment above but want it here attached to the accepted answer as well - we were only able to get this working after we moved the props.conf from the indexer cluster to the HF running HEC itself. When running on the indexer cluster it was as if the props.conf didn't even exist.

burras · ‎04-07-2017

Thanks to Support I was able to get this working. We found a couple of different things: 1) The props.conf was really close - we had to make 1 change to get it working properly (missing an escape on +[)?) ). Here's the final props.conf that worked: [asset_play] CHARSET=UTF-8 SHOULD_LINEMERGE=false disabled=false SEDCMD-fixfooters=s/]}//g LINE_BREAKER=([\r\n,]*(?:{[^[{]+\[)?){"earlyAccess TRUNCATE=0 TIME_PREFIX="deviceTimestamp": MAX_TIMESTAMP_LOOKAHEAD=30 TIME_FORMAT=%s%3N KV_MODE=json 2) We also discovered that putting props.conf on the indexer cluster did not work. Anything that was brought in through HEC was essentially untouched by anything in props.conf on an indexer. We had to specify this props.conf on the HF on which HEC was running. Thanks everyone for your help with this!

burras · ‎03-30-2017

I definitely agree - it sounds like it should be working. Here's what I'm seeing in the btool output: /opt/splunk/etc/apps/search/local/props.conf [asset_play] /opt/splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True /opt/splunk/etc/system/default/props.conf AUTO_KV_JSON = true /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE = /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True /opt/splunk/etc/system/local/props.conf CHARSET = UTF-8 /opt/splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml /opt/splunk/etc/system/default/props.conf HEADER_MODE = /opt/splunk/etc/system/local/props.conf KV_MODE = json /opt/splunk/etc/system/default/props.conf LEARN_MODEL = true /opt/splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true /opt/splunk/etc/system/local/props.conf LINE_BREAKER = ([\r\n,]*(?:{[^[{]+[)?){"earlyAccess /opt/splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100 /opt/splunk/etc/system/default/props.conf MATCH_LIMIT = 100000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800 /opt/splunk/etc/system/default/props.conf MAX_EVENTS = 256 /opt/splunk/etc/system/local/props.conf MAX_TIMESTAMP_LOOKAHEAD = 30 /opt/splunk/etc/system/default/props.conf MUST_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE = /opt/splunk/etc/system/local/props.conf SEDCMD-fixfooters = s/]}//g /opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing /opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full /opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner /opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer /opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none /opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard /opt/splunk/etc/system/local/props.conf SHOULD_LINEMERGE = false /opt/splunk/etc/system/local/props.conf TIME_FORMAT = %s%3N /opt/splunk/etc/system/local/props.conf TIME_PREFIX = "deviceTimestamp": /opt/splunk/etc/system/default/props.conf TRANSFORMS = /opt/splunk/etc/system/local/props.conf TRUNCATE = 0 /opt/splunk/etc/apps/search/local/props.conf TZ = UTC /opt/splunk/etc/apps/search/local/props.conf category = Custom /opt/splunk/etc/apps/search/local/props.conf description = dena asset_play /opt/splunk/etc/system/default/props.conf detect_trailing_nulls = false /opt/splunk/etc/system/local/props.conf disabled = false /opt/splunk/etc/system/default/props.conf maxDist = 100 /opt/splunk/etc/system/default/props.conf priority = /opt/splunk/etc/apps/search/local/props.conf pulldown_type = 1 /opt/splunk/etc/system/default/props.conf sourcetype = I'm not seeing anything obvious that looks like it would be causing a problem. But running with this configuration gives me an output that's still just a single event so there's gotta be something going on somewhere...

burras · ‎03-30-2017

We're definitely using the "raw" input for HEC. Any chance that there's a disconnect between what would be seen in the "Add Data" section breaking and what would actually be shown in production? Where it might work in one but not the other?

burras · ‎03-29-2017

I tried with this props.conf but it's still showing as a single event for me. I can see all of the individual event data in the fields prefaced by event{}. but my customer really needs it broken into individual events because of the different timestamps in each event. The transactional data they're looking at is very time sensitive so just using that first deviceTimestamp field isn't close enough.

burras · ‎03-29-2017

We're getting the data from an external DENA forwarder that's just doing a HTTP push to our receiver. I'll investigate jq and take a look but I'm not confident that rearranging the architecture is an option - we've got some significant limitations in the environment that might make that sort of solution unfeasible (lack of storage, exponential growth expectations for this type of data, etc.).

burras · ‎03-28-2017

I've even gotten to the point now where instead of just removing the commas between events I actually introduced a newline between events - and it still doesn't want to break. I don't know if its something that I'm doing wrong or a problem with the data itself... SEDCMD-removeeventcommas=s/},{"earlyAccess":/}\n{"earlyAccess":/g LINE_BREAKER=(}\n){"earlyAccess

burras · ‎03-27-2017

I know there's a ton of these questions out here but I've got one of my own. I've looked at the other questions out there and between them and some initial help from Bert gotten a good start but I can't seem to get this to work right. We have a single JSON package being received via HEC - this package contains anywhere from 1 to 500 events. Our users would like those events broken out into individual events within Splunk. Here's what the initial package looks like: {"batch_id":"0-39-1490386204359","sampling_rate":1,"n":500,"events":[{"earlyAccess":null,"profileId":"d037d7da-bd83-11e6-80d6-0a2c5cb56663","ip":"74.000.000.238","deviceVersion":[{"component":"app","build":"oncue#1.19.37.108208#mallard2_GA.0","otherDetail":null},{"component":"service","build":"qa-a.stb.fios.tv","otherDetail":null},{"component":"location","build":"1000.00,1000.00","otherDetail":null},{"component":"Client","build":"108208#release_signed","otherDetail":null}],"__lane":"prod","__host":"unknown","navigationStack":[{"name":"Playback","index":0,"type":"LINEAR"}],"platformVersion":"108208#release_signed","assetType":"LinearAsset","assetId":"50281370fd523ecbaafd8f4d8145e006-adf51f1b5b403b6daa88b62d9c8567fa-2017-03-24-1","restrictedBy":null,"programStartTime":1490380200000,"attributionId":"8cca77ff-1480-b037-b0b2-015b01e09338","assetSessionId":"1490386121819","__sourceType":"device","serviceTimestamp":null,"appVersion":"1.19.37.108208","playType":"tuneIn","collectionId":"","deviceType":"501","accountId":"1004249","playRate":1000,"maestro":{"vhoId":"","host":"qa-a-aws.stb.fios.tv","userAgent":"Mozilla/5.0 (STB; CPU 501 OS 108208) OnCue/1.19.37","version":"4.4.3851","inHome":true,"ipAddress":"74.000.000.238"},"encoderDelay":124000,"__eventId":"s9a98hR/sMGKvAFbAe90tQ==","__timestamp":1490386121909,"sessionId":"617F6EA8-1490385232","__eventName":"1","programEndTime":1490390100000,"programId":"adf51f1b5b403b6daa88b62d9c8567fa","__source":"unknown","liveTuneType":"live","deviceTimestamp":1490386121819,"deviceId":"617F6EA8","__eventVersion":16,"recordingId":null,"channelId":"50281370fd523ecbaafd8f4d8145e006","timeZone":"America/New_York","eventProgramPoint":1490386121714},{"earlyAccess":null,"profileId":"45737761-ac2b-11e6-80d6-0a2c5cb56663","ip":"68.000.000.133","deviceVersion":[{"component":"app","build":"oncue#1.19.40.108253#mallard2_GA.0","otherDetail":null},{"component":"service","build":"qa-a.stb.fios.tv","otherDetail":null},{"component":"location","build":"1000.00,1000.00","otherDetail":null},{"component":"Client","build":"108253#release","otherDetail":null}],"__lane":"prod","__host":"unknown","navigationStack":[{"name":"","index":0,"type":""}],"platformVersion":"108253#release","assetType":"LinearAsset","assetId":"2732f41bdecc33aca2a23146eabd0954-5e4c3aaa6ef7312b8104c94c842d6a3f-2017-03-24-1","restrictedBy":null,"programStartTime":1490385600000,"attributionId":"ffffffff-ffff-ffff-ffff-fffffffffff","assetSessionId":"1490386010685","__sourceType":"device","serviceTimestamp":null,"appVersion":"1.19.40.108253","playType":"tuneOut","collectionId":"","deviceType":"501","accountId":"1003469","playRate":0,"maestro":{"vhoId":"","host":"qa-a-aws.stb.fios.tv","userAgent":"Mozilla/5.0 (STB; CPU 501 OS 108253) OnCue/1.19.40","version":"4.4.3851","inHome":true,"ipAddress":"68.000.000.133"},"encoderDelay":49000,"__eventId":"uXvQcxR/sMGKvAFbAe6R2w==","__timestamp":1490386063835,"sessionId":"617F7743-1490378565","__eventName":"1","programEndTime":1490387400000,"programId":"5e4c3aaa6ef7312b8104c94c842d6a3f","__source":"unknown","liveTuneType":"live","deviceTimestamp":1490386063730,"deviceId":"617F7743","__eventVersion":16,"recordingId":null,"channelId":"2732f41bdecc33aca2a23146eabd0954","timeZone":"America/New_York","eventProgramPoint":1490387400000}]} So far, I'm apply the following props.conf to this data: CHARSET=UTF-8 SHOULD_LINEMERGE=false disabled=false SEDCMD-removeheader=s/^(\{[\w\W]+\[{"earlyAccess":)/{"earlyAccess":/g SEDCMD-removeeventcommas=s/},{"earlyAccess":/}{"earlyAccess":/g SEDCMD-fixfooter=s/\]\}//g LINE_BREAKER={"earlyAccess TRUNCATE=0 TIME_PREFIX="deviceTimestamp": TIME_FORMAT=%s%3N KV_MODE=json That gives me this output but doesn't break between events: {"earlyAccess":null,"profileId":"d037d7da-bd83-11e6-80d6-0a2c5cb56663","ip":"74.000.000.238","deviceVersion":[{"component":"app","build":"oncue#1.19.37.108208#mallard2_GA.0","otherDetail":null},{"component":"service","build":"qa-a.stb.fios.tv","otherDetail":null},{"component":"location","build":"1000.00,1000.00","otherDetail":null},{"component":"Client","build":"108208#release_signed","otherDetail":null}],"__lane":"prod","__host":"unknown","navigationStack":[{"name":"Playback","index":0,"type":"LINEAR"}],"platformVersion":"108208#release_signed","assetType":"LinearAsset","assetId":"50281370fd523ecbaafd8f4d8145e006-adf51f1b5b403b6daa88b62d9c8567fa-2017-03-24-1","restrictedBy":null,"programStartTime":1490380200000,"attributionId":"8cca77ff-1480-b037-b0b2-015b01e09338","assetSessionId":"1490386121819","__sourceType":"device","serviceTimestamp":null,"appVersion":"1.19.37.108208","playType":"tuneIn","collectionId":"","deviceType":"501","accountId":"1004249","playRate":1000,"maestro":{"vhoId":"","host":"qa-a-aws.stb.fios.tv","userAgent":"Mozilla/5.0 (STB; CPU 501 OS 108208) OnCue/1.19.37","version":"4.4.3851","inHome":true,"ipAddress":"74.000.000.238"},"encoderDelay":124000,"__eventId":"s9a98hR/sMGKvAFbAe90tQ==","__timestamp":1490386121909,"sessionId":"617F6EA8-1490385232","__eventName":"1","programEndTime":1490390100000,"programId":"adf51f1b5b403b6daa88b62d9c8567fa","__source":"unknown","liveTuneType":"live","deviceTimestamp":1490386121819,"deviceId":"617F6EA8","__eventVersion":16,"recordingId":null,"channelId":"50281370fd523ecbaafd8f4d8145e006","timeZone":"America/New_York","eventProgramPoint":1490386121714}{"earlyAccess":null,"profileId":"45737761-ac2b-11e6-80d6-0a2c5cb56663","ip":"68.000.000.133","deviceVersion":[{"component":"app","build":"oncue#1.19.40.108253#mallard2_GA.0","otherDetail":null},{"component":"service","build":"qa-a.stb.fios.tv","otherDetail":null},{"component":"location","build":"1000.00,1000.00","otherDetail":null},{"component":"Client","build":"108253#release","otherDetail":null}],"__lane":"prod","__host":"unknown","navigationStack":[{"name":"","index":0,"type":""}],"platformVersion":"108253#release","assetType":"LinearAsset","assetId":"2732f41bdecc33aca2a23146eabd0954-5e4c3aaa6ef7312b8104c94c842d6a3f-2017-03-24-1","restrictedBy":null,"programStartTime":1490385600000,"attributionId":"ffffffff-ffff-ffff-ffff-fffffffffff","assetSessionId":"1490386010685","__sourceType":"device","serviceTimestamp":null,"appVersion":"1.19.40.108253","playType":"tuneOut","collectionId":"","deviceType":"501","accountId":"1003469","playRate":0,"maestro":{"vhoId":"","host":"qa-a-aws.stb.fios.tv","userAgent":"Mozilla/5.0 (STB; CPU 501 OS 108253) OnCue/1.19.40","version":"4.4.3851","inHome":true,"ipAddress":"68.000.000.133"},"encoderDelay":49000,"__eventId":"uXvQcxR/sMGKvAFbAe6R2w==","__timestamp":1490386063835,"sessionId":"617F7743-1490378565","__eventName":"1","programEndTime":1490387400000,"programId":"5e4c3aaa6ef7312b8104c94c842d6a3f","__source":"unknown","liveTuneType":"live","deviceTimestamp":1490386063730,"deviceId":"617F7743","__eventVersion":16,"recordingId":null,"channelId":"2732f41bdecc33aca2a23146eabd0954","timeZone":"America/New_York","eventProgramPoint":1490387400000} The actual event break should be taking place at: {"earlyAccess": I've tried LINE_BREAKER in various formats as well as trying combinations of BREAK_ONLY_BEFORE and MUST_BREAK_AFTER but haven't had any luck getting the breaks to happen - Splunk still processes it all as a single event. Everything else is working fine with it - it's just not breaking. Any assistance on how to get these darn things to break right would be greatly appreciated...

Posts	62
Solutions	3
Karma Given	5
Karma Received	8
Member Since	‎10-07-2013

Online Status	Offline
Date Last Visited	‎10-19-2021 03:04 PM

Issue getting multi-value field to correlate prope...

Can all fields be outputted with outputcsv in doub...

Converting alphanumeric field to numeric values (3...

Splunk App for NetApp - Add Clusters vs Individual...

DMC - Show Health Check results for more than 100 ...

JSON - Breaking single string into multiple events

Customized reports from EMC Isilon App for Splunk ...

How to build a timechart that shows overall (n+1) ...

Extend finite fields into the future in conjunctio...

How to have my summary index only index on the cal...

Re: Calculating IOPS using FIO testing

Re: Issue getting multi-value field to correlate p...

Issue getting multi-value field to correlate prope...

Re: Can all fields be outputted with outputcsv in ...

Re: DMC - Show Health Check results for more than ...

Re: Splunk App for NetApp - Add Clusters vs Indivi...

Can all fields be outputted with outputcsv in doub...

Re: Converting alphanumeric field to numeric value...

Re: Converting alphanumeric field to numeric value...

Re: Converting alphanumeric field to numeric value...

Re: Converting alphanumeric field to numeric value...

Re: Converting alphanumeric field to numeric value...

Re: Converting alphanumeric field to numeric value...

Converting alphanumeric field to numeric values (3...

Splunk App for NetApp - Add Clusters vs Individual...

Re: DMC - Show Health Check results for more than ...

DMC - Show Health Check results for more than 100 ...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

Re: JSON - Breaking single string into multiple ev...

JSON - Breaking single string into multiple events