topic Re: Indexing JSON - problem in Deployment Architecture

Indexing JSON - problem

bugnet — Tue, 29 Sep 2020 10:59:39 GMT

Hi all,

I have json data that incoming from FIREEYE but can't parsing.
I'm working with cluster environment.

inputs.conf on the heavy forwarder:

Blockquote

[tcp://6012]
index=fire_eye
sourcetype=_json
disabled=0

Blockquote

The events shown in Splunk but not parsing.

aakwah — Tue, 29 Sep 2020 11:02:11 GMT

Hello,

I think you should assing json KV_MODE for your sourcetype, stantz like this in props.conf

[_json] 
KV_MODE = json

May be you need to set TIME_FORMAT and LINE_BREAKER as well.

If the above doesn't work thanks to send sample from log.

Regards

bugnet — Mon, 26 Sep 2016 13:42:27 GMT

Hi,

As I mentioned - I'm working with cluster environment.
accordingly, Where I need to edit the props.conf? in the cluster master?