Splunk parsing

uagraw01 — Thu, 23 May 2024 10:41:38 GMT

Hello Splunkers!!

I want to ingest below two pattern of events in Splunk and both are in json logs but there timestamp are different. So far I have used below attributes in my props.conf. Please let me know or suggest me if any any other attribute I need to add so my both the pattern of events parse smoothly without any time difference..

[exp_json]
AUTO_KV_JSON = false
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
TIME_PREFIX = \"time\"\:\"
category = Custom
pulldown_type = true

Pattern 1:
{"datacontenttype":"application/json","data":{"identificationStatus":"NO_IDENTIFICATION_ATTEMPTED","location":"urn:topology:segment:1103.20.15-1103.20.19","carrierId":null,"trackingId":"dc268ac7-168a-11ef-b02a-1feae60bb414"},"subject":"CarrierPositionUpdate","messages":[],"specversion":"1.0","classofpayload":"com.vanderlande.conveyor.boundary.event.business.outbound.CarrierPositionUpdate","id":"8252fb03-2eb2-4619-a59b-24e3280f9bda","source":"conveyor","time":"2024-05-20T09:29:53.361800Z","type":"CarrierPositionUpdate"}

Pattern 2:
{"data":{"physicalId":"60040160041570014272","carrierTypeId":"18","carrierId":"60040160041570014272","prioritizedDestinations":[{"name":"urn:topology:location:Pallet Loop (DEP):OBD/Returnflow:Exit01","priority":1},{"name":"urn:topology:location:Pallet Loop (DEP):OBD/Returnflow:Exit02","priority":1}],"transportOrderId":"TO_00001399"},"topic":"transport-order-commands-conveyor","specversion":"1.0","time":"2024-05-22T18:02:16.669Z","id":"34A0DF56-B0B2-4A73-9D7B-034A94D49747","type":"AssignTransportOrder"}

Thanks in advance!!

Re: Splunk parsing

ITWhisperer — Thu, 23 May 2024 10:51:00 GMT

Ideally, these should be ingested as different sourcetypes so that different parsing can be associated with the different formats.

Re: Splunk parsing

uagraw01 — Thu, 23 May 2024 11:09:23 GMT

@ITWhisperer I am not using TIME_FORMAT attribute here, then probably it should work ? Please share your thoughts.

Re: Splunk parsing

ITWhisperer — Thu, 23 May 2024 11:18:22 GMT

As I said, these look like two different sourcetypes and should be treated as such

topic Splunk parsing in Getting Data In

Splunk parsing

Re: Splunk parsing

Re: Splunk parsing

Re: Splunk parsing