topic Re: Json file loading and indexing in Getting Data In

Json file loading and indexing

erra27372 — Tue, 29 Sep 2020 16:41:32 GMT

Hi all,
I am trying to load and index a json file with the FREE version of SPLUNK.

After loaded the file I cannot see the events and the search does not retrieve any data.

The test used file is:
{
"custom_classes": 0,
"images": [
{
"classifiers": [
{
"classes": [
{
"class": "banana",
"score": 0.562,
"type_hierarchy": "/fruit/banana"
},
{
"class": "fruit",
"score": 0.788
},
{
"class": "diet (food)",
"score": 0.528,
"type_hierarchy": "/food/diet (food)"
},
{
"class": "food",
"score": 0.528
},
{
"class": "honeydew",
"score": 0.5,
"type_hierarchy": "/fruit/melon/honeydew"
},
{
"class": "melon",
"score": 0.501
},
{
"class": "olive color",
"score": 0.973
},
{
"class": "lemon yellow color",
"score": 0.789
}
],
"classifier_id": "default",
"name": "default"
}
],
"image": "fruitbowl.jpg"
}
],
"images_processed": 1
}

How can I correctly load a json file and configure parameters for it ?

Thanks to all in advance.

Re: Json file loading and indexing

koshyk — Fri, 10 Nov 2017 16:29:14 GMT

if its pure-json , you can do indexed extractions

# inputs.conf
[monitor:///tmp/json_pure/*]
sourcetype=myjson
index=someIndex

and in props.conf

#props.conf
[myjson]
INDEXED_EXTRACTIONS = JSON

In reality, the props.conf may be bit more complex. This is because your data payload will contain time and you need to specify which field it has to extract the time etc.

Re: Json file loading and indexing

erra27372 — Mon, 13 Nov 2017 09:58:53 GMT

Hi thanks for writing.
I tried to update the two files as you suggested but still not working. 😞