topic How to write props for JSON logs? in Splunk Enterprise

How to write props for JSON logs?

Vani_26 — Thu, 25 Aug 2022 20:11:51 GMT

Below is the sample log:

{[-]
context: default

level: INFO

logger: logginfdata.pre-request.util

mdc: { [+]

}

message: this is a json request

[evenId=76546787678888899999]]

thread: RealtimeExecutor-1999

timestamp: 2022-03-23 15:44:41.965

}

may i know how can write props for this kind of logs.

Re: How to write props for JSON logs?

kamlesh_vaghela — Fri, 26 Aug 2022 05:50:16 GMT

@Vani_26

Can you please share a valid JSON sample event? Just copy _raw and mask data with sample values. Now paste it into the code block. Find this (</>) tool in the toolbar for the code block popup. This will help us to answer you with a proper solution.