Getting Data In

JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search?

anthonycopus
Path Finder

I have some simple, correctly designed, JSON logs being sent to Splunk.

However, Splunk is not automatically parsing the fields unless I add | spath to the search. What configuration do I need to change so I could simply do:

index=main event_name=demo

instead of

 index=main | spath | event_name=demo

Thanks!

0 Karma
1 Solution

jplumsdaine22
Influencer

Have you got KV_MODE=json in your props.conf for that sourcetype?

See http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf

View solution in original post

jplumsdaine22
Influencer

Have you got KV_MODE=json in your props.conf for that sourcetype?

See http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf

anthonycopus
Path Finder

Thanks, exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...