Getting Data In

Issue with Monitoring files in Splunk

sdivya
Observer

i m trying to monitor a  json file with custom sourcetype for line breaking that i have build but not getting events .  But the same json file, if i'll upload with same custom sourcetype it is able to index properly and events are showing with correct parsing. And, also if i monitor the same json file with predefined sourcetype=_json it is able to index the file and showing the events though the parsing is wrong.

Any suggestions?

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...