Getting Data In

How to use props.conf to parse json file in splunk

camellia
Engager

Hi

I am new to splunk. I set up a single-site cluster to parse a JSON-formatted log. I use cm in the path of /opt/splunk/etc/manager-apps/_cluster/local. conf and transforms.conf configuration files were sent to index in the path /opt/splunk/etc/peer-apps/_cluster/local. However, when I searched in the search header, the desired effect was not found.

props.conf

[itsd]
DATETIME_CONFIG = CURRENT
KV_MODE = json
LINE_BREAKER = ([\r\n]+)
category = Structured
disabled = false
pulldown_type = true
TRANSFORMS-null1 = replace_null
TRANSFORMS-null2 = replace_null1

 

transforms.conf

[replace_null]
REGEX = ^\[
DEST_KEY=queue
FORMAT=nullQueue

[replace_null1]
REGEX=(.*)(\}\s?\})
DEST_KEY=_raw
FORMAT=$1$2

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @camellia,

You need to configure these in the forwarder not on the indexer servers. Also,  KV_MODE = json is search time configuration, not index-time configuration.

Set INDEXED_EXTRACTIONS = JSON for your sourcetype in props.conf. Deploy props.conf and transforms.conf in your forwarder.

[itsd]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = JSON
LINE_BREAKER = ([\r\n]+)
category = Structured
disabled = false
pulldown_type = true
TRANSFORMS-null1 = replace_null
TRANSFORMS-null2 = replace_null1

 

View solution in original post

manjunathmeti
Champion

hi @camellia,

You need to configure these in the forwarder not on the indexer servers. Also,  KV_MODE = json is search time configuration, not index-time configuration.

Set INDEXED_EXTRACTIONS = JSON for your sourcetype in props.conf. Deploy props.conf and transforms.conf in your forwarder.

[itsd]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = JSON
LINE_BREAKER = ([\r\n]+)
category = Structured
disabled = false
pulldown_type = true
TRANSFORMS-null1 = replace_null
TRANSFORMS-null2 = replace_null1

 

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...