Getting Data In

Json file loading and indexing

erra27372
New Member

Hi all,
I am trying to load and index a json file with the FREE version of SPLUNK.

After loaded the file I cannot see the events and the search does not retrieve any data.

The test used file is:
{
"custom_classes": 0,
"images": [
{
"classifiers": [
{
"classes": [
{
"class": "banana",
"score": 0.562,
"type_hierarchy": "/fruit/banana"
},
{
"class": "fruit",
"score": 0.788
},
{
"class": "diet (food)",
"score": 0.528,
"type_hierarchy": "/food/diet (food)"
},
{
"class": "food",
"score": 0.528
},
{
"class": "honeydew",
"score": 0.5,
"type_hierarchy": "/fruit/melon/honeydew"
},
{
"class": "melon",
"score": 0.501
},
{
"class": "olive color",
"score": 0.973
},
{
"class": "lemon yellow color",
"score": 0.789
}
],
"classifier_id": "default",
"name": "default"
}
],
"image": "fruitbowl.jpg"
}
],
"images_processed": 1
}

How can I correctly load a json file and configure parameters for it ?

Thanks to all in advance.

0 Karma

erra27372
New Member

Hi thanks for writing.
I tried to update the two files as you suggested but still not working. 😞

0 Karma

koshyk
Super Champion

if its pure-json , you can do indexed extractions

# inputs.conf
[monitor:///tmp/json_pure/*]
sourcetype=myjson
index=someIndex

and in props.conf

#props.conf
[myjson]
INDEXED_EXTRACTIONS = JSON

In reality, the props.conf may be bit more complex. This is because your data payload will contain time and you need to specify which field it has to extract the time etc.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...