Getting Data In
Highlighted

JSON Import Into Splunk with Nested Fields

Explorer

I'm trying to import some JSON with nested field using the "Add Data" function, but I can't quite get the regex/ parsing correct. I want to pull everything in the "source" section.

The JSON events look like:

{
        "_index": "INDEX",
        "_type": "EVENT TYPE",
        "_id": "EVENTID",
        "_score": #,
        "_source": {
          "resp_pkts": #,
          "type": "TYPE",
          "id_orig_p": PORT,
          "duration": DURATION,
           "proto": "PROTOCOL",
          "received_timestamp": TIMESTAMP IN EPOCH,
          "ts": LOG TIMESTAMP
        }
      },

I have the following set in the props.conf
CHARSET UTF8
DATETIMECONFIG CURRENT
SHOULD
LINEMERGE true
NOBINARYCHECK true
BREAKONLYBEFORE "_source:{"
disabled false
KV_MODE json

0 Karma
Highlighted

Re: JSON Import Into Splunk with Nested Fields

Motivator

Can you post the whole json?

0 Karma
Highlighted

Re: JSON Import Into Splunk with Nested Fields

Explorer

I faced the same issue. The problem is with the "source" key in the input json. Replace it with something like "data". Then Splunk recognizes all fields.,I have the same problem. The issue is with key "source" in the input json. Replace it with some else for example: "data". Then you see all the fields inside data subjson.

0 Karma