Getting Data In

Has anybody indexed json format file

htsvaggar
New Member

Hi,

Has anybody done parsing JSON file.

If you can let me know what are the setting being done
in input.conf and props.conf files.

Thanks
sanjeev

Tags (2)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee
KV_MODE=json

is all you need to set unless your log requires special settings to extract the timestamp.

0 Karma

htsvaggar
New Member

Thanks

That did not work.

At least I should see the different source type in the event search. I am not seeing either.

Regards

0 Karma

satishsdange
Builder

Could you please refer to below link-
http://answers.splunk.com/answers/218306/json-format-is-not-getting-indexed.html

If that does not solve your problem, please share some sample logs.

Thanks

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...