Can Splunk read a file in JSON format?

[pfabrizi]

We are trying to pull in slack data using function1 which is not work as we are using the new api. We had a call with slack and they suggested to create a custom app. In the interim what we would like to is create a script that fetches the slack events and writes to a file and then use a file monitor to retrieve the events.
Slack returns the data in json, so how would I setup the file monitor to read json? Or would I just format the data in the script that retrieves slack?

Thanks!

[amiftah · Accepted solution]

@pfabrizi:

your inputs.conf should look like this:

[monitor:////test/sample.json]
disabled = false
index = yourIndex
sourcetype = _json

You can read more about monitoring here: http://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf

[pfabrizi]

Thank You!

[amiftah]

Yes you can.
There is a predefined sourcetype for json called _json

https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Listofpretrainedsourcetypes

[pfabrizi]

Hi Amiftah,
So I would just add this to my inputs.conf?

source=_json
sourcetype=box

thanks!