I have single event looking like below and trying to figure the best way for Splunk to recognize the key-value pairs. Ideally would have each line as a separate event.
{
"compsModelObjectName": "Desktop",
"compsObjectList": [
{
"buildGUID": "8D36EF88-3319-4770-BDD3-DCDA614C40DB",
"buildType": "ONEDESK - FULLBUILD",
"buildVersion": "2.22.080214-1002",
"description": "MY TEXT IN HERE",
"purpose": "Normal",
"lastScanDate": "Apr 29, 2010",
"assetName": "WLDNETSBWGS41J",
"dateModified": "Mar 27, 2013",
"dateInstalled": "Dec 17, 2009",
"invNo": "DIMS-1268745",
"serialNo": "BWGS41J",
"manufacturer": "UNKNOWN",
"model": "UNKNOWN PC",
"assetTag": "Z00880152",
"status": "INAC",
"productClass": "UNKNOWN PC",
"productType": "UNKNOWN",
"owner": "X1111111",
"subStatus": "Disposal",
"compsIdentifier": "DIMS-1268745"
},
{
"buildGUID": "JENYX1111111XP",
"buildType": "JENY",
"description": "Unknown Class",
"purpose": "Normal",
"lastScanDate": "Nov 1, 2010",
"assetName": "JENYX1111111XP",
"dateModified": "Mar 31, 2011",
"dateInstalled": "Jan 1, 1970",
"invNo": "TEXTTEXT",
"serialNo": "JENYX1111111XP",
"manufacturer": "JENY",
"model": "JENY",
"assetTag": "D04936865",
"status": "INAC",
"productClass": "JENY",
"productType": "JENY",
"owner": "X1111111",
"subStatus": "Disposal",
"compsIdentifier": "DIMS-4182421"
},
{
"buildGUID": "JENYX1111111",
"buildType": "JENY",
"description": "Unknown Class",
"purpose": "Normal",
"lastScanDate": "Nov 21, 2011",
"assetName": "JENYX1111111",
"dateModified": "Nov 20, 2011",
"dateInstalled": "Jan 1, 1970",
"invNo": "DIMS-4827747",
"serialNo": "JENYX1111111",
"manufacturer": "JENY",
"model": "JENY",
"assetTag": "D06722795",
"status": "INAC",
"productClass": "JENY",
"productType": "JENY",
"owner": "X1111111",
"subStatus": "Disposal",
"compsIdentifier": "DIMS-4827747"
},
{
"buildGUID": "2DB77FB4-C1D2-4AD4-9453-4A06D4017076",
"buildType": "xSPACE - FULLBUILD",
"buildVersion": "4.12",
"description": "Business Basic PC",
"domain": "EMEA",
"purpose": "Normal",
"lastScanDate": "Aug 30, 2016",
"assetName": "WC2291Y7F",
"dateModified": "Aug 31, 2016",
"dateInstalled": "Jun 24, 2013",
"invNo": "DIMS-5916063",
"serialNo": "CZC2291Y7F",
"manufacturer": "DP",
"model": "Z611",
"assetTag": "08192",
"status": "AC",
"productClass": "Desktop",
"productType": "DESKTOP",
"owner": "X1111111",
"subStatus": "CONFIGURED",
"compsIdentifier": "DIMS-5916063"
}
],
"statusCode": 200
}
↧
