topic Re: What are the steps to configure Splunk to parse and index JSON data? in Getting Data In

What are the steps to configure Splunk to parse and index JSON data?

chaseto — Tue, 17 Nov 2015 18:13:58 GMT

Hello Experts,

I am very new to Splunk. I can import data into Splunk from .csv file by:
add data->select source->sourcetype(access_combined)->next and click save.
I can view the data by searching by giving the correct index and source name.

In the same way, what is the process for JSON data? Can anyone explain me the detail steps of it starting from the props.conf?

Below is the sample data which I have

{"version":"2.4","user":{"zipCode":"","pcnNumber":""},"event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"},"productInfo":[{"productName":"DeltaGold","pmc":"113"}]}],"page":{"attributes":{"rbpnIndicator":"","preApproval":"NPA","appCache":"","appType":"Co-Brand","channel":"Non-DTW","rwd":"desktop","appConfig":"","experience":"Microsite","partner":"dal","acqCardType":"CCSG","appDecision":"","partnerAppType":"Co-Brand","acqExperience":"Microsite","productInfo":[{"productName":"DeltaGold","pmc":"113"}],"applicationId":"CPI_WEB","formName":"appForm","tool":"","autotrack":false,"appLength":"Long","decisionIndicator":"","flowType":"Prospect","sid":"2s0Hfr1lhsBhm8ad3hw01C2"},"pageInfo":{"country":"US","language":"en","pageID":"ng31hcrmnnh11zp","pageName":"DeltaGold_StartApp"},"category":{"primaryCategory":"Acq","subCategory1":"CCSG","subCategory2":"Microsite","businessUnit":"AMEX","subCategory3":"CPI"}}}

In the above data, do I get a separate field for each separated by semicolon and separate fields for the one which are there in the flower brackets?
example: "event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"}

Sorry for such a big question and thank you in advance

Re: What are the steps to configure Splunk to parse and index JSON data?

sundareshr — Tue, 17 Nov 2015 18:47:30 GMT

Here are a couple of links that may help

https://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html

https://kzhendev.wordpress.com/2015/01/19/consuming-json-with-splunk-in-two-simple-steps/

Re: What are the steps to configure Splunk to parse and index JSON data?

pramit46 — Tue, 17 Nov 2015 18:57:00 GMT

I would add the following line under the respective sourcetype stanza.

kv_mode=json

or use spath in the query.

Re: What are the steps to configure Splunk to parse and index JSON data?

chaseto — Tue, 17 Nov 2015 19:05:16 GMT

Thank You for the response .I figured how the process is done,on the other side I want know does it have seperate fields for the one which is in the flower brackets

"event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"}

like eventAction and eventType in two different fields.

Re: What are the steps to configure Splunk to parse and index JSON data?

mkemmerer — Wed, 18 Nov 2015 15:03:09 GMT

spath is probably going to work best since you've got arrays in your data. Searching through arrays of objects can get a bit ugly in my experience.

Re: What are the steps to configure Splunk to parse and index JSON data?

chaseto — Wed, 18 Nov 2015 17:49:35 GMT

so are you saying once the data is in splunk, instead of regurlar search using spath gives a clear picture..right?