https://community.splunk.com/t5/Getting-Data-In/Any-way-to-process-mixed-Apache-and-JSON-format-data/m-p/456660#M78929 <P>Can you please provide some sample logs (Please mask sensitive data) ?</P> Wed, 31 Oct 2018 18:50:25 GMT harsmarvania57 2018-10-31T18:50:25Z https://community.splunk.com/t5/Getting-Data-In/Any-way-to-process-mixed-Apache-and-JSON-format-data/m-p/456659#M78928 <P>We have some apps that mix apache log and json data in the same log file. Is there a way to extract both data types, and still successfully format the json? We have "INDEXED_EXTRACTIONS = json, KV_MODE = none" in the props.conf file (splunkforwarder-6.4.2), and the apache log lines are ignored. I was under the impression KV_MODE=none would not ignore them. I thought the way we have this set up was supposed to do what I want: Properly format json lines and just ingest other lines without indexing?</P> Tue, 29 Sep 2020 21:51:17 GMT https://community.splunk.com/t5/Getting-Data-In/Any-way-to-process-mixed-Apache-and-JSON-format-data/m-p/456659#M78928 wsanderstii 2020-09-29T21:51:17Z https://community.splunk.com/t5/Getting-Data-In/Any-way-to-process-mixed-Apache-and-JSON-format-data/m-p/456660#M78929 <P>Can you please provide some sample logs (Please mask sensitive data) ?</P> Wed, 31 Oct 2018 18:50:25 GMT https://community.splunk.com/t5/Getting-Data-In/Any-way-to-process-mixed-Apache-and-JSON-format-data/m-p/456660#M78929 harsmarvania57 2018-10-31T18:50:25Z