Getting Data In

Json Event Breaking Issues

NickLaurent
New Member

Hi Folks,

Splunk Ent V6.5.2

I have a curly one here. I have a Json file ( sample below).
When the file is ingested events don't always get separated. The props is on a HF.

Thanks in advance.

I have the following props.conf.

[ ss_api2 ]
CHARSET=UTF-8
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
TIME_PREFIX=timestamp
TRUNCATE = 500000
category=custom
description=Slipstream Prod/Beta api.
disabled=false
pulldown_type=true

Json sample:

{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\r\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable1 parameters)\\r\\n at Autofac.Features.Indexed.KeyedServiceIndex2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d_10.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 186\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.d2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.d0.MoveNext() MS_LoggedBy: System.Collections.Generic.List1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"e0d465f5-8a37-47de-94c0-ad77a8e83493\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configenvironments?apptype=DigitalPlatform\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4029" }
{ "details": "{ \"exception\": \"Autofac.Core.Registration.ComponentNotRegisteredException: The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.\\r\\n at Autofac.ResolutionExtensions.ResolveService(IComponentContext context, Service service, IEnumerable
1 parameters)\r\n at Autofac.Features.Indexed.KeyedServiceIndex`2.get_Item(TKey key)\r\n at DeploymentDashboard.Api.Controllers.ConfigurationsController.d
3.MoveNext() in E:\\teamcity-agent\\work\\54de5f5aa4fe1c72\\api\\DeploymentDashboard.Api\\Controllers\\ConfigurationsController.cs:line 39\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Threading.Tasks.TaskHelpersExtensions.d3`1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ApiControllerActionInvoker.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Web.Http.Filters.ActionFilterAttribute.d5.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Filters.ActionFilterAttribute.d0.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ActionFilterResult.d2.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Web.Http.Controllers.ExceptionFilterResult.d_0.MoveNext() MS_LoggedBy: System.Collections.Generic.List`1[System.Object]\" }", "exception": "The requested service 'DigitalPlatform (DeploymentDashboard.Services.Configurations.IConfigurationsService)' has not been registered. To avoid this exception, either register a component to provide the service, check for service registration using IsRegistered(), or use the ResolveOptional() method to resolve an optional dependency.", "message": "{\"correlationId\":\"46bee1fe-04af-40f0-97ba-1a4954f87bdd\",\"method\":\"GET\",\"requestUri\":\"http:\/\/beta.slipstream.dev.XXXX:00\/services\/api\/configscopes?apptype=DigitalPlatform&scopetype=shared\"}", "level": "ERROR", "type": "Autofac.Core.Registration.ComponentNotRegisteredException", "timestamp": "2017-11-17 16:22:56.4149" }

0 Karma
1 Solution

maciep
Champion

You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.

For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.

Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...

[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25

View solution in original post

0 Karma

maciep
Champion

You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events.

For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag.

Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent...

[ss_api2]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":)
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n
TIME_PREFIX="timestamp":\s*"
MAX_TIMESTAMP_LOOKAHEAD=25
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...