question Re: PutSplunk processor and Splunk group multiple syslog jsons into one event in Archives of Support Questions (Read Only)

PutSplunk processor and Splunk group multiple syslog jsons into one event

wbu — Mon, 19 Aug 2019 11:49:42 GMT

Hi,

I'm using PutSplunk processor to sink syslogs in json format to Splunk server.

But on Splunk side, I see multiple json are grouped in one event.

How can I configure my PutSplunk and Splunk server to see one json for each event?

Regards,

Wendell

Re: PutSplunk processor and Splunk group multiple syslog jsons into one event

andrewg — Wed, 04 Jan 2017 00:06:47 GMT

Make sure you split data using the SplitJson processor in NiFi before putting into Splunk. The reason is the syslog receiver may bundle incoming messages based on the network setup, but knows nothing about actual data format like json.

Re: PutSplunk processor and Splunk group multiple syslog jsons into one event

bbende — Wed, 04 Jan 2017 00:06:54 GMT

PutSplunk has two modes of operating, it can send the entire content of the flow file as a single message, or it can stream the content of a flow file and separate it based on a delimiter. The way it chooses between these modes is based on whether or not the "Message Delimiter" property is set in PutSplunk.

In your case I am assuming you have multiple JSON documents in a flow file, so you probably want to set the "Message Delimiter" to whatever is separating them, likely a \n.

Re: PutSplunk processor and Splunk group multiple syslog jsons into one event

wbu — Wed, 04 Jan 2017 00:22:55 GMT

Hi,

Actually, the flowfile in the queue before the PutSplunk does contain only one json.

For some reason the Splunk group them together. If I choose different json type (no timestamp) in splunk data, then each json in one event. But @Bryan Bende's "Message Delimiter" worth to be added.

Regards,

Wendell

Re: PutSplunk processor and Splunk group multiple syslog jsons into one event

sumanth_kumar — Mon, 19 Aug 2019 11:49:34 GMT

Hello @Wendell Bu , I am trying same , to send events from Nifi to Splunk (using putSplunk processor) . I was stuck initially , not able to see events in splunk . My AttributetoJSON (In my view data provenance ,I see raw logs are converted to JSON format) is connected to putSplunk processor , It has hostname,port and message delimiter configured as in below screenshot . On splunk side , input port is defined . Not sure if i am missing something .Can you please let me know if there are any other steps, i need to follow ?

Appreciate your help in advance !