Im monitoring a JSON file and forwarding the data using UF to my indexers . Im having problems to extract the JSON fields . Here is my props file . Nothing is being extracted ( i was trying to upload a screenshot but i dont have enought points ) . i know its something with the props but im unable to figure it out . any help would be appreciated
[test]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Structured
disabled = false
pulldown_type = true
Thanks
Check this out, https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html
The props.conf has to be on the UF with the INDEXED_EXTRACTIONS and the props also has to be on the SH with the KV_MODE=NONE