Getting Data In

JSON with Timestamp (syslog)

poisar
Explorer

Hello,

i am getting the following json via syslog and i ingest it to splunk.

Aug 13 12:45:40 10.200.7.200 {"Status": "Failed", "Received": "2020-08-13T10:45:07.2887421", "ToIP": null, "StartDate": "2020-08-13T10:44:39.530583Z", "Index": 2, "EndDate": "2020-08-13T10:45:39.530583Z", "FromIP": "2603:10a6:803:67::17"}

 

i want to extract the json data. So i created a new app on my searchhead with a props.conf for my custom sourcetype:

[security:type]
TIME_PREFIX = "Received":\s*"
# SEDCMD-strip_prefix = s/^[^{]+//g
SEDCMD-StripHeader = s/^[^\{]+//
INDEXED_EXTRACTIONS=JSON
KV_MODE=json
TZ = UTC

 

still it doesnt extract the json data. Can someone help me out?

 

thanks in advance!

Andreas

Labels (2)
Tags (1)
0 Karma

poisar
Explorer

Putting the props.conf on the indexer fixed my issue.

 

 

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...