I have a json file that contains 2000+ lines of data, it looks somewhat like this -
[
{
"line": 2,
"elements": [
{
"before": [
{
"result": {
"duration": 6692500639,
"status": "passed"
},
"match": {
"location": "some_value"
}
},
{
"result": {
"duration": 112646517,
"status": "passed"
},
"match": {
"location": "some_value"
}
}
],
"line": 21,
"name": "random_name",
"description": "",
"id": "random_id",
"after": [
{
"result": {
"duration": 2054619875,
"status": "passed"
},
"match": {
"location": "some_value"
}
}
],
"type": "scenario",
"keyword": "Scenario Outline",
"steps": [
{
"result": {
"duration": 3627081999,
"status": "passed"
},
"line": 5,
"name": "random_name",
"match": {
"location": "some_value"
},
"keyword": "Given "
},
{
"result": {
"duration": 126013564303,
"error_message": ""... more than 250 lines of stack trace over here ..."",
"status": "failed"
},
"line": 9,
"name": "random_name",
"match": {
"location": "some_value"
},
"keyword": "some_key"
}
}
-------- some more similar lines here ----------
],
"tags": [
{
"line": 1,
"name": "test_name"
},
{
"line": 1,
"name": "test_name"
}
]
}
],
"name": "random_name",
"description": "",
"id": "random_id",
"keyword": "Feature",
"uri": "random_uri",
"tags": [
{
"line": 1,
"name": "test_name"
},
{
"line": 1,
"name": "test_name"
}
]
}
]
Howevere splunk is only showing the first 108 lines from the file and not the whole
The SPL I used is -
index="test" host="localhost" sourcetype="json_data"
The location json file is on the indexer as well as on the forwarder. but nothing works.
Here are my configs for props.conf -
[json_data]
SHOULD_LINEMERGE = true
MUST_BREAK_AFTER = ]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRUNCATE = 0
NO_BINARY_CHECK = true
CHARSET = UTF-8
category = Structured
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = true
and what splunk displays -
Can someone please help.
Thanks!
If you need any other info please comment.
... View more
