Hi All,
I am looking for some pointers on integrating Couchbase with splunk, which means not sending couchbase logs, actually looking for JSON data integration in SPLUNk.
Kindly help me out on this.
Regards,
BK
Your simplest option is INDEXED_EXTRACTIONS=JSON
if you can handle the CPU load on your forwarder and the extra disk space on your Indexers:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extraction...
If not, do it as normal and use the KV_MODE=json
search-time setting:
http://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Propsconf
BE SURE NOT TO USE BOTH!