https://community.splunk.com/t5/Splunk-Search/Getting-a-json-file-into-Splunk-at-the-backend/m-p/701523#M237960 <P>Am having trouble getting a .json file into splunk through the backend to help support a customized dashboard. Is there a particular step i need to follow to get it in through the deployer?</P> Thu, 10 Oct 2024 12:16:03 GMT whitecat001 2024-10-10T12:16:03Z https://community.splunk.com/t5/Splunk-Search/Getting-a-json-file-into-Splunk-at-the-backend/m-p/701523#M237960 <P>Am having trouble getting a .json file into splunk through the backend to help support a customized dashboard. Is there a particular step i need to follow to get it in through the deployer?</P> Thu, 10 Oct 2024 12:16:03 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-json-file-into-Splunk-at-the-backend/m-p/701523#M237960 whitecat001 2024-10-10T12:16:03Z https://community.splunk.com/t5/Splunk-Search/Getting-a-json-file-into-Splunk-at-the-backend/m-p/701524#M237961 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/264928">@whitecat001</a>&nbsp;,</P><P>sorry but there's something strange in your request:</P><P>are you speaking about how to ingest json files in a forwarder or how to parse json files in Search Heads Cluster?</P><P>you spoke of Deployer that's used in Search Head Cluster, if your requirement is to parse a json file, you have to add INDEXED_EXTRACTIONS=JSON to the sourcetype using the web gui and this configuration is replicated to the hother Search Heads.</P><P>If instead you are speaking about how to ingest and parse a json file, you have to add INDEXED_EXTRACTIONS = JSON to the sourcetype in props.conf, in the forwarders using the Deployment Server or manually.</P><P>What's your requirement?</P><P>Ciao.</P><P>Giuseppe</P> Thu, 10 Oct 2024 12:31:53 GMT https://community.splunk.com/t5/Splunk-Search/Getting-a-json-file-into-Splunk-at-the-backend/m-p/701524#M237961 gcusello 2024-10-10T12:31:53Z