Getting Data In
Highlighted

Json file loading and indexing

New Member

Hi all,
I am trying to load and index a json file with the FREE version of SPLUNK.

After loaded the file I cannot see the events and the search does not retrieve any data.

The test used file is:
{
"customclasses": 0,
"images": [
{
"classifiers": [
{
"classes": [
{
"class": "banana",
"score": 0.562,
"type
hierarchy": "/fruit/banana"
},
{
"class": "fruit",
"score": 0.788
},
{
"class": "diet (food)",
"score": 0.528,
"typehierarchy": "/food/diet (food)"
},
{
"class": "food",
"score": 0.528
},
{
"class": "honeydew",
"score": 0.5,
"type
hierarchy": "/fruit/melon/honeydew"
},
{
"class": "melon",
"score": 0.501
},
{
"class": "olive color",
"score": 0.973
},
{
"class": "lemon yellow color",
"score": 0.789
}
],
"classifierid": "default",
"name": "default"
}
],
"image": "fruitbowl.jpg"
}
],
"images
processed": 1
}

How can I correctly load a json file and configure parameters for it ?

Thanks to all in advance.

0 Karma
Highlighted

Re: Json file loading and indexing

Super Champion

if its pure-json , you can do indexed extractions

# inputs.conf
[monitor:///tmp/json_pure/*]
sourcetype=myjson
index=someIndex

and in props.conf

#props.conf
[myjson]
INDEXED_EXTRACTIONS = JSON

In reality, the props.conf may be bit more complex. This is because your data payload will contain time and you need to specify which field it has to extract the time etc.

0 Karma
Highlighted

Re: Json file loading and indexing

New Member

Hi thanks for writing.
I tried to update the two files as you suggested but still not working. 😞

0 Karma