Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to onboard json file data to splunk?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi ,
Thanks in Advance
I am trying to onboard json file data to splunk .But i am not forwarding all the data from json file.
My json file format
{
"aaa": {
"modified_files": [
"a/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"a/D:\\\\splunk\\\\Repos\\\\/.git/config",
"a/D:\\\\splunk\\\\Repos\\\\/.git/index",
"a/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"]
},
"bbb": {
"modified_files": [
"b/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"b/D:\\\\splunk\\\\Repos\\\\/.git/config",
"b/D:\\\\splunk\\\\Repos\\\\/.git/index",
"b/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"
]
}
}
I am getting result as like this
{
"aaa": {
"modified_files": [
"a/D:\\\\splunk\\\\Repos\\\\/.git/HEAD",
"a/D:\\\\splunk\\\\Repos\\\\/.git/config",
"a/D:\\\\splunk\\\\Repos\\\\/.git/index",
"a/D:\\\\splunk\\\\Repos\\\\/.git/logs/HEAD"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Create a normal file monitor input and choose source type as json_no_timestamp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Create a normal file monitor input and choose source type as json_no_timestamp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Keep on monitoring the file in daily basis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check the link I have posted below.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But i need to monitor json file
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
for more info refer t o the link below
https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Monitorfilesanddirectorieswithinputs.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
File input does the same thing , it monitors file.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform
Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)
Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station
