Indexing JSON

pwjones89 — Fri, 03 May 2013 12:55:00 GMT

I am trying to index 555 JSON files accumulating to 293MB.
My inputs.conf is directed at the directory, assigned to the correct index established in indexes.conf, and sourcetype established in props.conf. Props.conf additionally contains KV_MODE = json and TRUNCATE=0. All these configurations have worked on a previous implementation of this setup on a different system.
Ultimately the files are recognised under the data inputs view in Splunk, however the index registers 0 events.
As mentioned, these settings worked in a previous implementation on a different system.
Wondering if anyone has come across similar issues, whether it is with file sizes or JSON implementation itself.

Re: Indexing JSON

yannK — Fri, 03 May 2013 15:10:28 GMT

Simply read the splunkd.log for details.

They may be considered as already indexed, if they have identical first 256 chars.
if this is case, try the crcSalt= in inputs.conf

see http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/HowLogFileRotationIsHandled

topic Re: Indexing JSON in Getting Data In

Indexing JSON

Re: Indexing JSON