How do I properly configure Splunk to index JSON data?

odedtagar — Tue, 25 Aug 2015 07:34:20 GMT

I'm trying to index a json file (below) using the preview of the Add data>Set sourcetype window, but every configuration I try returns no results.

Would appreciate getting a configuration that works:

{"Version":"1.0","Measures":[{"TopicName":"Topic 1","TopicId":"0001","StartTime":"2015-08-11 02:12:36.23",...}, {"TopicName":"Topic 1","TopicId":"0002","StartTime":"2015-08-11 02:15:36.23",...}...]}

Thanks,
Oded

Re: How do I properly configure Splunk to index JSON data?

somesoni2 — Tue, 25 Aug 2015 18:34:04 GMT

Try this (in the advanced tab)

SHOULD_LINEMERGE = false
TRUNCATE = 500000
DATETIME_CONFIG = CURRENT
KV_MODE = json

topic How do I properly configure Splunk to index JSON data? in Getting Data In

How do I properly configure Splunk to index JSON data?

Re: How do I properly configure Splunk to index JSON data?