I have configured Rest api and it is giving data in json format as a single event. I wants to split it into multiple events
ie, for example the data is in this format now
{ [-]
queryResponse: { [-]
@count: 4288943
@first: 0
@last: 99
@type: ClientSessions
entity: [ [-]
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 14
@id: 14
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 15
@id: 15
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 16
@id: 16
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
.
.
.
I want to split it as
event 1
entity: [ [-]
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 14
@id: 14
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
event 2
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 15
@id: 15
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
event 3
{ [-]
@dtoType: clientSessionsDTO
@type: ClientSessions
clientSessionsDTO: { [-]
@displayName: 16
@id: 16
anchorIpAddress: abcd
authenticationAlgorithm: xyz
authorizationPolicy: na
bytesReceived: 0
bytesSent: 0
webSecurity: abc
wgbStatus: dgghsd
}
}
how I can achieve this?
Thanks in advance.
Are you using REST API modular input app then I suggest one of my question below:
https://answers.splunk.com/answers/656804/need-help-to-parse-json-rest-api-response.html
You have to use Responsehandler to do this.