Getting Data In

Json file loading and indexing

erra27372
New Member

Hi all,
I am trying to load and index a json file with the FREE version of SPLUNK.

After loaded the file I cannot see the events and the search does not retrieve any data.

The test used file is:
{
"custom_classes": 0,
"images": [
{
"classifiers": [
{
"classes": [
{
"class": "banana",
"score": 0.562,
"type_hierarchy": "/fruit/banana"
},
{
"class": "fruit",
"score": 0.788
},
{
"class": "diet (food)",
"score": 0.528,
"type_hierarchy": "/food/diet (food)"
},
{
"class": "food",
"score": 0.528
},
{
"class": "honeydew",
"score": 0.5,
"type_hierarchy": "/fruit/melon/honeydew"
},
{
"class": "melon",
"score": 0.501
},
{
"class": "olive color",
"score": 0.973
},
{
"class": "lemon yellow color",
"score": 0.789
}
],
"classifier_id": "default",
"name": "default"
}
],
"image": "fruitbowl.jpg"
}
],
"images_processed": 1
}

How can I correctly load a json file and configure parameters for it ?

Thanks to all in advance.

0 Karma

erra27372
New Member

Hi thanks for writing.
I tried to update the two files as you suggested but still not working. 😞

0 Karma

koshyk
Super Champion

if its pure-json , you can do indexed extractions

# inputs.conf
[monitor:///tmp/json_pure/*]
sourcetype=myjson
index=someIndex

and in props.conf

#props.conf
[myjson]
INDEXED_EXTRACTIONS = JSON

In reality, the props.conf may be bit more complex. This is because your data payload will contain time and you need to specify which field it has to extract the time etc.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...