https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/478001#M82037 <P>Filename: xxx<BR /> dest: xxx<BR /> created_at: xxxx<BR /> destination_port: null<BR /> source: xxx<BR /> username: zxx</P> <P>above fields are not populating and time and date field which i have added those only populating</P> Wed, 30 Sep 2020 02:52:03 GMT vin02ptl 2020-09-30T02:52:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477997#M82033 <P>My log contains multiple {} data structure and i want to get all json field inside extracted field in splunk . How to parse?</P> <P>{ [-] <BR /> service: [ [-] <BR /> { [-] <BR /> name: xxxxx<BR /><BR /> id: xxx <BR /> }<BR /><BR /> ]<BR /><BR /> Filename: xxx<BR /><BR /> dest: xxx<BR /><BR /> created_at: xxxx<BR /> destination_port: null<BR /><BR /> source: xxx<BR /><BR /> username: zxx<BR /> }</P> Wed, 30 Sep 2020 02:52:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477997#M82033 vin02ptl 2020-09-30T02:52:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477998#M82034 <P>props.conf with KV_MODE set to JSON should do the trick for you</P> <P>Documentation on props.conf here - <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A></P> Sun, 03 Nov 2019 17:47:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477998#M82034 arjunpkishore5 2019-11-03T17:47:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477999#M82035 <P>i have tried, but fields are not reflecting under interesting field</P> Sun, 03 Nov 2019 17:54:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/477999#M82035 vin02ptl 2019-11-03T17:54:52Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/478000#M82036 <P>what are the fields showing up in Interesting fields ?</P> Sun, 03 Nov 2019 18:00:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/478000#M82036 arjunpkishore5 2019-11-03T18:00:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/478001#M82037 <P>Filename: xxx<BR /> dest: xxx<BR /> created_at: xxxx<BR /> destination_port: null<BR /> source: xxx<BR /> username: zxx</P> <P>above fields are not populating and time and date field which i have added those only populating</P> Wed, 30 Sep 2020 02:52:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-parsing-configuration-for-json-file/m-p/478001#M82037 vin02ptl 2020-09-30T02:52:03Z