topic Trouble indexing Amanda (backup) JSON files into Splunk in Getting Data In

Trouble indexing Amanda (backup) JSON files into Splunk

khhenderson — Tue, 29 Sep 2020 07:39:56 GMT

I have added the following to my props.conf file.

AMANDA JSON FILES

[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = json
Are there more changes that I could make to my props.conf file for better indexing?

The JSON file is indexing but it doesn't look good.
Is there a way to add a timestamp to the file as it's indexed?

Re: Trouble indexing Amanda (backup) JSON files into Splunk

somesoni2 — Fri, 23 Oct 2015 17:59:09 GMT

Could you post some sample json data?

Re: Trouble indexing Amanda (backup) JSON files into Splunk

khhenderson — Tue, 29 Sep 2020 07:39:58 GMT

  "output_size" : {
     "incr" : 51188360,
     "total" : 51188360,
     "full" : 0
  },
  "tapedisks" : "",
  "dles_dumped" : {
     "incr" : 4,
     "total" : 4,
     "full" : 0
  },
  "avg_compression" : {
     "incr" : "100.0",
     "total" : "100.0",
     "full" : "100.0"
  },
  "avg_dump_rate" : {
     "incr" : "49580.4",
     "total" : "49580.4",
     "full" : "-- "
  }

},
"summary" : [
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/app-uploads"
},
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/braingames-storage"
},

Re: Trouble indexing Amanda (backup) JSON files into Splunk

woodcock — Sat, 24 Oct 2015 07:00:58 GMT

Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json or KV_MODE = json but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT.