Has anybody indexed json format file

[htsvaggar]

Hi,

Has anybody done parsing JSON file.

If you can let me know what are the setting being done
in input.conf and props.conf files.

Thanks
sanjeev

[s2_splunk]

KV_MODE=json

is all you need to set unless your log requires special settings to extract the timestamp.

[htsvaggar]

Thanks

That did not work.

At least I should see the different source type in the event search. I am not seeing either.

Regards

[satishsdange]

Could you please refer to below link-
http://answers.splunk.com/answers/218306/json-format-is-not-getting-indexed.html

If that does not solve your problem, please share some sample logs.

Thanks