Getting Data In

Problem: Importing file of JSON data from Twitter results in one single event?

djtaylor74
New Member

Hi, I'm having a problem importing JSON formatted data into Splunk. It's retrieved via the Twitter API, stored in a file, and imported into Splunk via the universal forwarder. The result is that I get a single record (not the 94 I'm expecting to see), so I'm thinking it must be something to do with the file data format.

I've uploaded the file into a number of different JSON validators and all but one let it pass. It fails on jsonlint.com BUT, it then is validated fine on pro.jsonlint.com - figure that out!

So has anyone else come across this. I've had a good look in splunkbase, but only found one question similar-ish to this one.

I'm happy to provide further info if it helps, and also provide the file in question (I need more karma points to be able provide links here...).

Thanks.

Tags (3)
0 Karma

davecroto
Splunk Employee
Splunk Employee

You can solve this parsing problem by installing and using this app:

http://splunk-base.splunk.com/apps/56296/twitter-for-splunk

0 Karma

djtaylor74
New Member

I took a look at this app, but when entering my credentials on the set-up page I get:

Encountered the following error while trying to update: In handler 'localapps': Could not validate password for id="credential::djtaylor74:"

Anyone else encountered this type of error? Could it be a firewall issue?

So I've not been able to get any further with that particular app, and also I don't know if it'll meet my needs as I'm making very specific calls to the Twitter API and manipulating the JSON response before storing it.

Any further help greatly appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...