Couchbase integration with Splunk

[bharathkumarnec]

Hi All,

I am looking for some pointers on integrating Couchbase with splunk, which means not sending couchbase logs, actually looking for JSON data integration in SPLUNk.

Kindly help me out on this.

Regards,
BK

[woodcock]

Your simplest option is INDEXED_EXTRACTIONS=JSON if you can handle the CPU load on your forwarder and the extra disk space on your Indexers:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extraction...

If not, do it as normal and use the KV_MODE=json search-time setting:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Propsconf

BE SURE NOT TO USE BOTH!