Getting Data In

How to extract JSON at index time?

adexteracc
Explorer

I am trying to extract some json data at index time. I have found the article about using regular expressions to create custom fields but regex is not well suited to extracting json. I understand that spath can take out the json data during a search but in this case it is required that I extract the data into fields at index time.

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You can ingest the data using the _json sourcetype - this will enable indexed field extractions.

Alternatively, if you don't want to keep the _json sourcetype name, you can set INDEXED_EXTRACTION=JSON in props.conf.

0 Karma

hortonew
Builder

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...