Getting Data In

Indexing JSON

pwjones89
Engager

I am trying to index 555 JSON files accumulating to 293MB.
My inputs.conf is directed at the directory, assigned to the correct index established in indexes.conf, and sourcetype established in props.conf. Props.conf additionally contains KV_MODE = json and TRUNCATE=0. All these configurations have worked on a previous implementation of this setup on a different system.
Ultimately the files are recognised under the data inputs view in Splunk, however the index registers 0 events.
As mentioned, these settings worked in a previous implementation on a different system.
Wondering if anyone has come across similar issues, whether it is with file sizes or JSON implementation itself.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Simply read the splunkd.log for details.

They may be considered as already indexed, if they have identical first 256 chars.
if this is case, try the crcSalt= in inputs.conf

see http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/HowLogFileRotationIsHandled

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...