How to create add-on and where to code for further processing

[harshal_chakran]

I want to create an add-on in which I have to parse a file depending upon the tags and then route it to different sourcetypes.
The input file format is like this:

{

"ABC_CONFIGURATION":
{
"Hidden":"INFO_YES",
"orientation":"ORIENTATION_PORTRAIT",
"Layout":"SIZE_NORMAL+LONG_NO+LAYOUTDIR_LTR",
"seq":7,
"mnc":0,
"WidthDp":620
},

"EVENTSLOG":"01-04 02:13:19.249 I\/dvm_lock_sample( 1208): [system_server,1,main,37,WindowManagerService.java,6979,-,2814,7]\n
01-04 02:13:19.539 I\/dvm_lock_sample( 1208): [system_server,1,Binder_C,87,WindowManagerService.java,2627,WindowAnimator.java,96,17]\n
01-04 02:13:20.009 I\/wm_task_removed( 1208): [5,removeTask]\n
01-04 02:13:20.009 I\/wm_task_removed( 1208): [5,removeAppToken: last token]\n
01-04 02:13:40.959 I\/battery_level( 1208): [35,3658,309]\n

"USER_DATE":"1970-01-04T02:19:24.000+00:00",
"INFO":
{
"TIME":1406666986000,
"PRINT":"unknown",
"HARDWARE":"qcom",
"UNKNOWN":"unknown",
"RADIO":"unknown",
"LOADER":"unknown",
"VERSION":
{
"CODENAME":"REL",
"RELEASE":"4.4.3",
"SDK":19
},
"ABI":"v7a",
"ABI2":"abi",
"IS_DEBUGGABLE":true,
"TYPE":"userdebug"
}

}

I want to upload this file as ABC_CONFIGURATION in one sourcetype ,EVENTSLOG in different source type and similarly all the tags in different sourcetypes. So how to do this?
And how to do further processing in add-on?

[MuS · Accepted solution]

Hi harshal_chakranarayan,

like most of the times, best thing to do is consulting the docs about:

1. App and Add-on intro to get a basic understanding about add-ons
2. Where do I configure my Splunk settings to place the add-on at the right place
3. Filter event data and send to queues can be used as example but you need to change the MetaData:Sourcetype in
4. transforms.conf

hint on number 2: What you want to do is parsing

hope this helps ...

cheers, MuS