Getting Data In
Highlighted

Fields Extraction from JSON File

Path Finder

Im monitoring a JSON file and forwarding the data using UF to my indexers . Im having problems to extract the JSON fields . Here is my props file . Nothing is being extracted ( i was trying to upload a screenshot but i dont have enought points ) . i know its something with the props but im unable to figure it out . any help would be appreciated

[test]
DATETIMECONFIG =
INDEXED
EXTRACTIONS = json
KVMODE = none
LINE
BREAKER = ([\r\n]+)
NOBINARYCHECK = true
category = Structured
disabled = false
pulldown_type = true

Thanks

Tags (2)
0 Karma
Highlighted

Re: Fields Extraction from JSON File

Path Finder

Check this out, https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html

The props.conf has to be on the UF with the INDEXEDEXTRACTIONS and the props also has to be on the SH with the KVMODE=NONE

0 Karma