Getting Data In

linebreaker for json sourcetype

martinnepolean
Explorer

I am trying to break the below json data into each event

{"audit_logs": [{"url": "https://Company.udesk.com/api/v2/audit_logs/3650750.json", "id": 3650750, "actor_id": 27401, "source_id": 36012509503, "source_type": "view", "source_label": "View: Copy of ALL CX BC", "action": "create", "change_description": "", "ip_address": "116.10.16.1", "created_at": "2019-12-13T06:04:32Z", "user": "VASU JOGI"}, {"url": "https://Company.udesk.com/api/v2/audit_logs/365073140614.json", "id": 365073140614, "actor_id": 28319638, "source_id": 3600001411, "source_type": "account_setting", "source_label": "Account Assumption", "action": "update", "change_description": "Changed", "ip_address": "160.12.15.26", "created_at": "2019-12-12T22:18:14Z", "user": "Sejal Jack"}]}

from the above log event 1 should be as below and rest of the message should be another event.
{"url": "https://Company.udesk.com/api/v2/audit_logs/3650750.json", "id": 3650750, "actor_id": 27401, "source_id": 36012509503, "source_type": "view", "source_label": "View: Copy of ALL CX BC", "action": "create", "change_description": "", "ip_address": "116.10.16.1", "created_at": "2019-12-13T06:04:32Z", "user": "VASU JOGI"},

Below is my Props.conf which is deployed on UF. Please help to get it working

[_json]
LINE_BREAKER = (,*\s+){"url"
SHOULD_LINEMERGE = false

0 Karma

sumanssah
Communicator

try using below-mentioned search for your json index

search
   | rex "(?<json>\{.+)" | spath input=json | fields - json  
0 Karma

to4kawa
Ultra Champion

props.conf

[audit_json]
SEDCMD-trim = s/^.*\[(.*)\]}/\1/g
LINE_BREAKER = }(,)
KV_MODE = json
SHOULD_LINEMERGE = false
0 Karma

calcometer
Explorer

Use the path command mit curl braces.

https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Spath

|spath input=_raw output=events path=audit_logs{}

0 Karma

martinnepolean
Explorer

No it is not working? is it possible to do it via props file?

0 Karma

calcometer
Explorer

The input of _raw need to be the blank JSON String

0 Karma

martinnepolean
Explorer

yes i tried, but no luck? is it not possible to do the parsing via props.conf .I am looking for search time field extraction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...