Dashboards & Visualizations

Why is Json Data extraction props.conf not working?

DataOrg
Builder

Hello ,

I was testing the json extraction for a json data and its missing to index the last loop (Which is highligthed in Bold) starting from the RuntimeTasks.   Please help with the props.conf
{
    "Variant": "Tidesa",
    "File": "hello.hex",
     "Testgroup": "Accent",
    "Results": [
                            {
                                  "TestModule": "CustComm_CustIf",
                                  "Name": "Customer Output",
                                  "TestCases": [
                                                                 {
                                                                      "ID": 46563,
                                                                      "Title": "asfs_Signals",
                                                                       "Tested": 1,
                                                                        "Result": 1
                                                                  },
                                                                 {
                                                                      "ID": 46564,
                                                                      "Title": "af46564_ValueAverage",
                                                                      "Tested": 1,
                                                                      "Result": 1
                                                                  }
                                                       ]
                                      }
                            ],
             "RuntimeTasks": null,
            "BUILD_NUMBER": "306",
            "JOB_BASE_NAME": "testing_PG",
            "JOB_URL": "https://is-jvale.de.ats.com/Acp/job/Mks/job/RB_MS_jfaj_fajja_testing/306",
             "NODE_NAME": "ast967"
}

Labels (1)
Tags (3)
0 Karma

forecastingLogs
Splunk Employee
Splunk Employee

What does your props.conf looks like right know? 

0 Karma

DataOrg
Builder

@forecastingLogs 

I think its getting truncating if more data is present. how to index all data without missing events

[QualificationTests]
AUTO_KV_JSON =
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Database
disabled = false
pulldown_type = 1
truncate=0

I added it in limits.conf too

extraction_cutoff 

 

Tags (1)
0 Karma

GaetanVP
Contributor

Hello @DataOrg,

I do not know if it can cause the issue but truncate needs to be in capital letter : TRUNCATE = 0
The AUTO_KV_JSON = <empty> is also weird, try to remove it.

Also what query are you using to search this json log after you had indexed it ?

I used the following props.conf and the json was not truncated :

[QualificationTests]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Database
disabled = false
pulldown_type = 1
TRUNCATE = 0


Hope it helps,
GaetanVP

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...