Getting Data In

Why does a single, short json file create multiple events in Splunk?

shawny2005
Path Finder

I have short json files that I am uploading via Splunk Forwarder, but when they go into my index, they are always 2 events. This breaks my searching. Attaching image so you can see what I mean. Any way to make sure that I get one event per json file?

alt text

I shortened the JSON file by 3 lines and now it uploads as a single event. Not sure why this is the case.

0 Karma
1 Solution

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

View solution in original post

0 Karma

shawny2005
Path Finder

I managed to solve it by, renaming the first element of the .json file. it was "comments": ""

that seems to have broken the parser for some reason. The first element was a "". Not sure why.

0 Karma

satishsdange
Builder
0 Karma

shawny2005
Path Finder

I think this is a different problem.

0 Karma

mpreddy
Communicator

Can you post some sample data.

if you want to combine total json file in to single event Give a try using this property in props.conf

SHOULD_LINEMERGE= TRUE

0 Karma

shawny2005
Path Finder

This is enabled True on defaults and I don't see any thing overriding it.

0 Karma

shawny2005
Path Finder
0 Karma

shawny2005
Path Finder

above is link to the way it looks in search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...