Getting Data In

How to extract JSON at index time?

adexteracc
Explorer

I am trying to extract some json data at index time. I have found the article about using regular expressions to create custom fields but regex is not well suited to extracting json. I understand that spath can take out the json data during a search but in this case it is required that I extract the data into fields at index time.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You can ingest the data using the _json sourcetype - this will enable indexed field extractions.

Alternatively, if you don't want to keep the _json sourcetype name, you can set INDEXED_EXTRACTION=JSON in props.conf.

0 Karma

hortonew
Builder

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...