JSON with Timestamp (syslog)

poisar — Thu, 13 Aug 2020 10:59:45 GMT

Hello,

i am getting the following json via syslog and i ingest it to splunk.

Aug 13 12:45:40 10.200.7.200 {"Status": "Failed", "Received": "2020-08-13T10:45:07.2887421", "ToIP": null, "StartDate": "2020-08-13T10:44:39.530583Z", "Index": 2, "EndDate": "2020-08-13T10:45:39.530583Z", "FromIP": "2603:10a6:803:67::17"}

i want to extract the json data. So i created a new app on my searchhead with a props.conf for my custom sourcetype:

[security:type]
TIME_PREFIX = "Received":\s*"
# SEDCMD-strip_prefix = s/^[^{]+//g
SEDCMD-StripHeader = s/^[^\{]+//
INDEXED_EXTRACTIONS=JSON
KV_MODE=json
TZ = UTC

still it doesnt extract the json data. Can someone help me out?

thanks in advance!

Andreas

Re: JSON with Timestamp (syslog)

poisar — Thu, 13 Aug 2020 12:46:55 GMT

Putting the props.conf on the indexer fixed my issue.

topic Re: JSON with Timestamp (syslog) in Getting Data In

JSON with Timestamp (syslog)

Re: JSON with Timestamp (syslog)