https://community.splunk.com/t5/Getting-Data-In/search-simple-json/m-p/540633#M90511 <P><A href="https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p/469435" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p/469435</A></P> Sat, 20 Feb 2021 03:52:24 GMT to4kawa 2021-02-20T03:52:24Z https://community.splunk.com/t5/Getting-Data-In/search-simple-json/m-p/540569#M90510 <P>I tried many ways to generate a properly formated json for splunk to parse it so i can put some alerts on my data but&nbsp; no&nbsp; success yet&nbsp; , nad the log is really simple&nbsp;</P><P>&nbsp;</P><P><SPAN class="t">2021-02-19T18:35:43</SPAN><SPAN>,</SPAN><SPAN class="t">878Z</SPAN><SPAN> [</SPAN><SPAN class="t">main</SPAN><SPAN>] </SPAN><SPAN class="t">INFO</SPAN> <SPAN class="t">dev-AniMatchIngester</SPAN> <SPAN class="t">-</SPAN><SPAN> { "</SPAN><SPAN class="t">createTS</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">2021-02-19T10:35:43Z</SPAN><SPAN>", "</SPAN><SPAN class="t a"><SPAN class="t">accountId</SPAN></SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t a"><SPAN class="t">333333</SPAN></SPAN><SPAN>", "</SPAN><SPAN class="t">correlationId</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">1112222</SPAN><SPAN>", "</SPAN><SPAN class="t">msgType</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">raw_published</SPAN><SPAN>", "</SPAN><SPAN class="t">Outcome</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">Success</SPAN><SPAN>", "</SPAN><SPAN class="t">eventOccurrenceTimestamp</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">2020-01-14</SPAN> <SPAN class="t">08:12:07.111</SPAN><SPAN>", "</SPAN><SPAN class="t">Type</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">TEST</SPAN><SPAN>", "</SPAN><SPAN class="t">eventType</SPAN><SPAN>"</SPAN><SPAN class="t">:</SPAN><SPAN>"</SPAN><SPAN class="t">Success</SPAN><SPAN>" }</SPAN></P><P>&nbsp;</P><P><SPAN>I need to i deally want these fields in intresting fields section or at the least i should be able to do a meaning queries based on&nbsp;<SPAN class="t">eventOccurrenceTimestamp&nbsp; &gt; today etc., or&nbsp;Type =="test" comparisons&nbsp;it was so easy in elk .&nbsp;&nbsp;</SPAN></SPAN></P> Fri, 19 Feb 2021 18:56:41 GMT https://community.splunk.com/t5/Getting-Data-In/search-simple-json/m-p/540569#M90510 vashodha 2021-02-19T18:56:41Z https://community.splunk.com/t5/Getting-Data-In/search-simple-json/m-p/540633#M90511 <P><A href="https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p/469435" target="_blank">https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p/469435</A></P> Sat, 20 Feb 2021 03:52:24 GMT https://community.splunk.com/t5/Getting-Data-In/search-simple-json/m-p/540633#M90511 to4kawa 2021-02-20T03:52:24Z