Getting Data In

JSON, TCP Input and _meta

jeanmatthieu
Explorer

Hi!

I'm sending a JSON document to a TCP Data Input on my Splunk server.
I noticed the magical field _time that allows me to set the time stamp the event occurred on and was hoping I could use _meta to add fields to be indexed automatically.

For example, is there a way to extract 'computer' and 'browser' fields from the below JSON automatically ?

{
    "_meta": "computer::MacBook Pro browser::Safari",
    "_time":"2014-10-24'T'11:59:01'Z'",
}

Thank you for your help,
Jean-Matthieu

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You should just use normal JSON fields and don't worry about _meta as that's mainly for internal Splunk use. The entire JSON is already indexed, and if you set KV_MODE = json for the source/sourcetype in props.conf (on the search head), then Splunk will automatically do extractions on all JSON fields. Do you have any particular reason to want to create extra indexes for other fields?

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You should just use normal JSON fields and don't worry about _meta as that's mainly for internal Splunk use. The entire JSON is already indexed, and if you set KV_MODE = json for the source/sourcetype in props.conf (on the search head), then Splunk will automatically do extractions on all JSON fields. Do you have any particular reason to want to create extra indexes for other fields?

jeanmatthieu
Explorer

Nice. Thank you. Is there a way to limit what gets transformed into a fields please ?
The KV_MODE addition to props.conf created 15000+ fields and I only really need about 20 of these.

I use _meta in the default stanza in ./etc/system/local/inputs.conf through the forwarder when pushing computer logs.
I would like to create/index the same fields when pushing json from my app through tcp.

Thank you for your help!

0 Karma

MuS
Legend

Take a look at the spath command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Spath this should help you....

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...