Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I configure props.conf to split a json array into multiple events?

$
0
0
Below is sample json input I am getting from REST API: { [-] calls: [ [-] { [-] apiName: Mobileshop apiVersion: 1 appName: MyAPP bytesSent: 228 datetime: 2015-11-09T10:30:38.786Z devOrgName: xyz envName: DEV planName: Mobile planVersion: 1 queryString: st=jbccc31 requestBody: requestHeaders: requestMethod: GET requestProtocol: https resourceName: responseBody: responseHeaders: statusCode: 200 timeToServeRequest: 3684 uriPath: /abxapi/dev/shop/mobilecatalog/v2/details.json userAgent: } { [-] apiName: RetailRegistration apiVersion: 1 appName: MyAPP bytesSent: 370 datetime: 2015-11-09T10:30:38.183Z devOrgName: xyz envName: DEV planName: Support planVersion: 1 queryString: st=jbccc31 requestBody: requestHeaders: requestMethod: GET requestProtocol: https resourceName: responseBody: responseHeaders: statusCode: 200 OK timeToServeRequest: 2531 uriPath: /abxapi/dev/support/retail/v2/details.xml userAgent: APIManagement/4.0 } ] next: 564518a7e4b0e65e3ab38367 nextHref: https://apimanager-nonprod.zxcv.com/v1/orgs/55cd0892e4b09972b93c77d4/environments/55f1bbf0e4b09972b941e141/events?next=564518a7e4b0e65e3ab38367 totalCalls: 82 } I want to break each one separately like below: apiName: RetailRegistration apiVersion: 1 appName: MyAPP bytesSent: 370 datetime: 2015-11-09T10:30:38.183Z devOrgName: xyz envName: DEV planName: Support planVersion: 1 queryString: st=jbccc31 requestBody: requestHeaders: requestMethod: GET requestProtocol: https resourceName: responseBody: responseHeaders: statusCode: 200 OK timeToServeRequest: 2531 uriPath: /abxapi/dev/support/retail/v2/details.xml userAgent: API/4.0 What should be my props.conf?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>