Just circling back an updating here. Couldn't get the above to work.
So i fixed it by re-writing my code to structure the JSON in a way that splunk would inherently split it, without any tweaking of props.conf.
heres what it spits out now, and splu7nk is parsing, just fine:
{
"BOMPREDapiPollTime": 1546140373.072095,
"BOMPREDdate": "2018-12-30T11:44:43+11:00",
"BOMPREDdescBrief": "Mostly sunny.",
"BOMPREDdescDetail": "Hot and mostly sunny. Winds west to northwesterly 15 to 20 km/h shifting east to northeasterly 15 to 25 km/h in the late morning and early afternoon then becoming light in the late evening.",
"BOMPREDfireDanger": "Very High",
"BOMPREDiconCode": 3,
"BOMPREDrainChance": 10,
"BOMPREDtempMax": 32,
"BOMPREDuvAlert": "Sun protection 8:30am to 5:20pm, UV Index predicted to reach 13 [Extreme]"
}
{
"BOMPREDapiPollTime": 1546140373.072095,
"BOMPREDdate": "2018-12-31T00:00:00+11:00",
"BOMPREDdescBrief": "Shower or two.",
"BOMPREDdescDetail": "Partly cloudy. Medium (50%) chance of showers, most likely in the evening. The chance of a thunderstorm in the afternoon and evening. Light winds becoming northeasterly 15 to 20 km/h in the evening then becoming light in the late evening.",
"BOMPREDiconCode": 11,
"BOMPREDrainChance": 50,
"BOMPREDrainMM": "0 to 1 mm",
"BOMPREDtempMax": 29,
"BOMPREDtempMin": 22
}
{
"BOMPREDapiPollTime": 1546140373.072095,
"BOMPREDdate": "2019-01-01T00:00:00+11:00",
"BOMPREDdescBrief": "Mostly sunny.",
"BOMPREDdescDetail": "Partly cloudy. Slight (20%) chance of a shower. The chance of a thunderstorm in the morning. Light winds becoming northeasterly 15 to 20 km/h during the day then becoming light during the afternoon.",
"BOMPREDiconCode": 3,
"BOMPREDrainChance": 20,
"BOMPREDtempMax": 30,
"BOMPREDtempMin": 23
}
... View more