topic Has anybody indexed json format file in Getting Data In

Has anybody indexed json format file

htsvaggar — Wed, 25 Feb 2015 20:12:11 GMT

Hi,

Has anybody done parsing JSON file.

If you can let me know what are the setting being done
in input.conf and props.conf files.

Thanks
sanjeev

s2_splunk — Wed, 25 Feb 2015 21:46:21 GMT

KV_MODE=json

is all you need to set unless your log requires special settings to extract the timestamp.

htsvaggar — Wed, 25 Feb 2015 22:10:35 GMT

Thanks

That did not work.

At least I should see the different source type in the event search. I am not seeing either.

Regards

satishsdange — Thu, 26 Feb 2015 03:25:06 GMT

If that does not solve your problem, please share some sample logs.

Thanks