topic Modify json structure for sourcetype that has indexed_extractions=json in Getting Data In

Modify json structure for sourcetype that has indexed_extractions=json

hortonew — Mon, 29 Apr 2019 16:14:49 GMT

We have a single Splunk instance with custom scripted input that pulls down json, and has indexed extractions.

New fields were added to the json that aren't getting extracted. We want to be able to remove the known headers that Splunk knows of (what fields to extract), so that it can start over and pick up newly added fields. Is there any method of doing this?

Are our only options: 1) change sourcetype or 2) use search time extractions?

Re: Modify json structure for sourcetype that has indexed_extractions=json

hortonew — Mon, 29 Apr 2019 16:20:39 GMT

All I can find in the docs is:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata
No support for mid-file renaming of header fields
Some software, such as Internet Information Server, supports the renaming of header fields in the middle of the file. Splunk software does not recognize changes such as this. If you attempt to index a file that has header fields renamed within the file, the renamed header field is not indexed.

Re: Modify json structure for sourcetype that has indexed_extractions=json

woodcock — Tue, 30 Apr 2019 06:57:47 GMT

It does not work like that. Splunk does not cache headers for INDEXED_EXTRACTIONS. If it seems to be doing so, try deleting the file so that it is rewritten with a fresh header line.

Re: Modify json structure for sourcetype that has indexed_extractions=json

hortonew — Tue, 30 Apr 2019 11:56:20 GMT

Which file?

Re: Modify json structure for sourcetype that has indexed_extractions=json

woodcock — Wed, 01 May 2019 04:00:16 GMT

The file that you are monitoring in your inputs.conf:

[monitor:///Your/Path/To/YourFileHere]