How to onboard json file data to Splunk?

[karthi2809]

Hi ,

Thanks in Advance

I am trying to onboard json file data to splunk .But i am not forwarding all the data from json file.

My json file format

{
"aaa": {
"modified_files": [
"a/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"a/D:\\\\splunk\\\\Repos\\\\/.git/config",
"a/D:\\\\splunk\\\\Repos\\\\/.git/index",
"a/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"]

},

"bbb": {
"modified_files": [

"b/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"b/D:\\\\splunk\\\\Repos\\\\/.git/config",
"b/D:\\\\splunk\\\\Repos\\\\/.git/index",
"b/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"

] 
}
}

I am getting result as like this

{
"aaa": {
"modified_files": [
"a/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"a/D:\\\\splunk\\\\Repos\\\\/.git/config",
"a/D:\\\\splunk\\\\Repos\\\\/.git/index",
"a/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"

[SinghK · Accepted solution]

Create a normal file monitor input and choose source type as json_no_timestamp

[karthi2809]

Keep on monitoring the file in daily basis 

[SinghK]

Check the link I have posted below.

[karthi2809]

But i need to monitor json file

[SinghK]

for more info refer t o the link below

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Monitorfilesanddirectorieswithinputs.conf 

[SinghK]

File input does the same thing , it monitors file.