topic Re: Multiple Json types in one file. How do i get data into Splunk in Getting Data In

Multiple Json types in one file. How do i get data into Splunk

robertlynch2020 — Wed, 04 Apr 2018 05:05:49 GMT

I have one file with multiple JSON types in it.
What is the best way to get this data into Splunk.
I dont think i can use a universal forwarder as i cant specify the sourcetype as i is multiple.

Someone said use a heavy forward and do the work of splitting the data into different source types before i send it.

Is this the correct approach?

Thanks
Robert Lynch

Re: Multiple Json types in one file. How do i get data into Splunk

splunker12er — Wed, 04 Apr 2018 05:50:45 GMT

spath command, it will do that for you, you may refer to the below link for using spath

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/spath

Re: Multiple Json types in one file. How do i get data into Splunk

p_gurav — Wed, 04 Apr 2018 06:44:36 GMT

This may help you:

https://answers.splunk.com/answers/567087/how-to-split-data-into-separate-sourcetypes-with-t.html

Re: Multiple Json types in one file. How do i get data into Splunk

niketn — Wed, 04 Apr 2018 13:11:03 GMT

@robertlynch2020, your indexer can also do this job, but better approach like you have said is to use heavy forward to set different sourcetype based on different JSON from the same source through props.conf and transforms.conf for sourcetype override.

Refer to Splunk Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides#Example:_Assign_a_source_type_to_events_from_a_single_input_but_different_hosts

And Splunk Blog: https://www.splunk.com/blog/2010/02/11/sourcetypes-gone-wild.html

Re: Multiple Json types in one file. How do i get data into Splunk

starcher — Wed, 04 Apr 2018 16:05:57 GMT

If the source can be edited to write to different files per sourcetype that is most ideal.

Another option that doesn't involve the universal forwarder is ingest the file using python and send to Splunk HTTP Event collector. A bit more complex but more flexible than doing regex routing at indexers.

Re: Multiple Json types in one file. How do i get data into Splunk

robertlynch2020 — Thu, 05 Apr 2018 09:45:20 GMT

Thanks, this is the answer i went with 🙂

Re: Multiple Json types in one file. How do i get data into Splunk

robertlynch2020 — Thu, 05 Apr 2018 09:45:49 GMT

This is the answer that i went with

https://answers.splunk.com/answers/567087/how-to-split-data-into-separate-sourcetypes-with-t.html

Cheers to all 🙂