Getting Data In

Can Splunk read a file in JSON format?

pfabrizi
Path Finder

We are trying to pull in slack data using function1 which is not work as we are using the new api. We had a call with slack and they suggested to create a custom app. In the interim what we would like to is create a script that fetches the slack events and writes to a file and then use a file monitor to retrieve the events.
Slack returns the data in json, so how would I setup the file monitor to read json? Or would I just format the data in the script that retrieves slack?

Thanks!

Tags (2)
0 Karma
1 Solution

amiftah
Communicator

@pfabrizi:

your inputs.conf should look like this:

[monitor:////test/sample.json]
disabled = false
index = yourIndex
sourcetype = _json

You can read more about monitoring here: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

View solution in original post

0 Karma

amiftah
Communicator

@pfabrizi:

your inputs.conf should look like this:

[monitor:////test/sample.json]
disabled = false
index = yourIndex
sourcetype = _json

You can read more about monitoring here: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma

amiftah
Communicator

Yes you can.
There is a predefined sourcetype for json called _json

https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Listofpretrainedsourcetypes

0 Karma

pfabrizi
Path Finder

Hi Amiftah,
So I would just add this to my inputs.conf?

source=_json
sourcetype=box

thanks!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...