Getting Data In

Can you help me with a line breaking issue in a Multi-line JSON file input with an array of records?

reed_kelly
Contributor

I have input files from MS Graph with pretty-printed JSON that looks something like the following (ellipses used liberally...). I am unable to find the right LINE_BREAKER value or BREAK_ONLY_BEFORE or BREAK_ONLY_AFTER to split the records on the comma between the }, and the {. Note that this sample has had the indentation with extra spaces removed.

    [
        {
            "@odata.type":  "#Microsoft.graph....",
            "id":  "...",
            "...":  "...",
            "foobar":  { 
                                  "foo1":  "bar1",
                                  "foo2":  "bar2",
                            },
            "...":  "...",
            "barfoo":  {
                                  "bar1":  "foo1",
                                  "bar2":  "foo2",
                            }
        },
        {
            "@odata.type":  "#Microsoft.graph....",
            "id":  "...",
            "...":  "...",
        },
        {
            "...":  "...",
            "...":  "...",
        }
    ]

This props.conf fails, because there are other }, strings within each record (see end of "foobar"):

[json]
TRUNCATE = 0
KV_MODE = json
TIME_PREFIX = \"xxxEventDateTime\":\"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N
MUST_BREAK_AFTER = \s*}\,

This is for a 6.5.x Splunk hwf feeding a 6.5.x indexer cluster.

0 Karma
1 Solution

reed_kelly
Contributor

I found the following to work:

TRUNCATE = 0
SHOULD_LINEMERGE = false
PREAMBLE_REGEX = ^\s*\[\s*$
LINE_BREAKER = }(,\s*[\r\n]*\s*){

View solution in original post

0 Karma

reed_kelly
Contributor

I found the following to work:

TRUNCATE = 0
SHOULD_LINEMERGE = false
PREAMBLE_REGEX = ^\s*\[\s*$
LINE_BREAKER = }(,\s*[\r\n]*\s*){
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...