topic Re: uploading json data file does not get parsed properly in Getting Data In

uploading json data file does not get parsed properly

sawgata12345 — Mon, 13 Nov 2017 11:52:08 GMT

Hi I tried to upload file in json format but after uploading whole json is showing as single entry and no event getting gerenated from it. What is the correct JSON format for splunk? Is there any special format of JSON that Splunk understands?

Re: uploading json data file does not get parsed properly

richgalloway — Mon, 13 Nov 2017 13:57:37 GMT

What are your props.conf settings for that sourcetype?

Re: uploading json data file does not get parsed properly

jbarlow_splunk — Tue, 29 Sep 2020 16:43:02 GMT

no special format. just json

you may need to do INDEXED_EXTRACTIONS = json in props.conf..
per
http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Extractfieldsfromfileswithstructureddata

there is also search time KV_MODE=json

(but do not set both KV_MODE and INDEXED_EXTRACTIONS ...its an either or,,, will get duplicate fields if both set)
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

Re: uploading json data file does not get parsed properly

sawgata12345 — Wed, 17 Jan 2018 09:55:29 GMT

Hi,
I found the answer to my question.
The json file should be in below format
{
"key":"value",
"key2":"value2"
}
{
"key":"value",
"key2":"value2"
}

Just upload the file it will get indexed and search queries also work nicely