Getting Data In

Indexing JSON

pwjones89
Engager

I am trying to index 555 JSON files accumulating to 293MB.
My inputs.conf is directed at the directory, assigned to the correct index established in indexes.conf, and sourcetype established in props.conf. Props.conf additionally contains KV_MODE = json and TRUNCATE=0. All these configurations have worked on a previous implementation of this setup on a different system.
Ultimately the files are recognised under the data inputs view in Splunk, however the index registers 0 events.
As mentioned, these settings worked in a previous implementation on a different system.
Wondering if anyone has come across similar issues, whether it is with file sizes or JSON implementation itself.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Simply read the splunkd.log for details.

They may be considered as already indexed, if they have identical first 256 chars.
if this is case, try the crcSalt= in inputs.conf

see http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/HowLogFileRotationIsHandled

Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...