topic Re: JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search? in Getting Data In

JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search?

anthonycopus — Wed, 25 Nov 2015 11:32:31 GMT

I have some simple, correctly designed, JSON logs being sent to Splunk.

However, Splunk is not automatically parsing the fields unless I add | spath to the search. What configuration do I need to change so I could simply do:

index=main event_name=demo

instead of

 index=main | spath | event_name=demo

Thanks!

Re: JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search?

jplumsdaine22 — Wed, 25 Nov 2015 13:20:30 GMT

Have you got KV_MODE=json in your props.conf for that sourcetype?

See http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf

Re: JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search?

anthonycopus — Fri, 04 Dec 2015 13:47:04 GMT

Thanks, exactly what I needed!