We are pulling some data from REST using REST API Modular Input (splunkbase.splunk.com/app/1546/), Response type json, and receiving the below response
{
currentServerTime: 2021-05-07T07:01:35.652+0000
measurements: [
{
count: 0
open: true
resultId: CSA_S_FT_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_7
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_6
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_5
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_4
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_2
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
calculatedTimeInSeconds: 0
count: 0
open: true
resultId: CSA_N_REG_L_2
time: 00:10:00
timeInSeconds: 600
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_4
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_8
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_6
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
calculatedTimeInSeconds: 0
count: 0
open: true
resultId: CSA_N_FT_L_8
time: 00:05:00
timeInSeconds: 300
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_5
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_8
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_7
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_10
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_REG_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_9
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_REG_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_3
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_2
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_S_FT_L_1
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
{
count: 0
open: true
resultId: CSA_N_FT_L_ANY
time: 00:00:00
timeInSeconds: 0
updated: 2021-05-07T07:01:00.000+0000
}
]
}
We would like to split each individual result into individual events using "updated" as the timestamp, however, no matter what I have tried, I can't get Splunk to break the events.
I've tried writing a custom response handler, but it's not working, this isn't my area of expertise so i'm really struggling! This is what I have written.
class BlipTrackHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for measurement in output["measurements"]:
measurement["timestamp"] = output["measurements"]["updated"]
print_xml_stream(json.dumps(measurement))
else:
print_xml_stream(raw_response_output)
Is anyone able to help?
Solved it myself
class BlipTrackHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for measurement in output["measurements"]:
measurement["currentServerTime"] = output["currentServerTime"]
print_xml_stream(json.dumps(measurement))
else:
print_xml_stream(raw_response_output)
And changed the sourcetype to json_no_timestamp