Getting Data In
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

How to extract JSON at index time?

adexteracc
Explorer

I am trying to extract some json data at index time. I have found the article about using regular expressions to create custom fields but regex is not well suited to extracting json. I understand that spath can take out the json data during a search but in this case it is required that I extract the data into fields at index time.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You can ingest the data using the _json sourcetype - this will enable indexed field extractions.

Alternatively, if you don't want to keep the _json sourcetype name, you can set INDEXED_EXTRACTION=JSON in props.conf.

0 Karma

hortonew
Builder

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

0 Karma