topic Re: How to onboard json file data to splunk? in Getting Data In

How to onboard json file data to Splunk?

karthi2809 — Tue, 31 May 2022 14:15:39 GMT

Hi ,

Thanks in Advance

I am trying to onboard json file data to splunk .But i am not forwarding all the data from json file.

My json file format

{
"aaa": {
"modified_files": [
"a/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"a/D:\\\\splunk\\\\Repos\\\\/.git/config",
"a/D:\\\\splunk\\\\Repos\\\\/.git/index",
"a/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"]

"bbb": {
"modified_files": [

"b/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"b/D:\\\\splunk\\\\Repos\\\\/.git/config",
"b/D:\\\\splunk\\\\Repos\\\\/.git/index",
"b/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"

]
}
}

I am getting result as like this

Re: How to onboard json file data to splunk?

SinghK — Tue, 31 May 2022 13:44:13 GMT

Create a normal file monitor input and choose source type as json_no_timestamp

Re: How to onboard json file data to splunk?

karthi2809 — Tue, 31 May 2022 13:53:08 GMT

But i need to monitor json file

Re: How to onboard json file data to splunk?

SinghK — Tue, 31 May 2022 13:56:26 GMT

File input does the same thing , it monitors file.

Re: How to onboard json file data to splunk?

SinghK — Tue, 31 May 2022 14:00:56 GMT

for more info refer t o the link below

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Monitorfilesanddirectorieswithinputs.conf

Re: How to onboard json file data to splunk?

karthi2809 — Tue, 31 May 2022 14:28:58 GMT

Keep on monitoring the file in daily basis

Re: How to onboard json file data to splunk?

SinghK — Tue, 31 May 2022 14:34:11 GMT

Check the link I have posted below.