Getting Data In

Json file loading and indexing

erra27372
New Member

Hi all,
I am trying to load and index a json file with the FREE version of SPLUNK.

After loaded the file I cannot see the events and the search does not retrieve any data.

The test used file is:
{
"custom_classes": 0,
"images": [
{
"classifiers": [
{
"classes": [
{
"class": "banana",
"score": 0.562,
"type_hierarchy": "/fruit/banana"
},
{
"class": "fruit",
"score": 0.788
},
{
"class": "diet (food)",
"score": 0.528,
"type_hierarchy": "/food/diet (food)"
},
{
"class": "food",
"score": 0.528
},
{
"class": "honeydew",
"score": 0.5,
"type_hierarchy": "/fruit/melon/honeydew"
},
{
"class": "melon",
"score": 0.501
},
{
"class": "olive color",
"score": 0.973
},
{
"class": "lemon yellow color",
"score": 0.789
}
],
"classifier_id": "default",
"name": "default"
}
],
"image": "fruitbowl.jpg"
}
],
"images_processed": 1
}

How can I correctly load a json file and configure parameters for it ?

Thanks to all in advance.

0 Karma

erra27372
New Member

Hi thanks for writing.
I tried to update the two files as you suggested but still not working. 😞

0 Karma

koshyk
Super Champion

if its pure-json , you can do indexed extractions

# inputs.conf
[monitor:///tmp/json_pure/*]
sourcetype=myjson
index=someIndex

and in props.conf

#props.conf
[myjson]
INDEXED_EXTRACTIONS = JSON

In reality, the props.conf may be bit more complex. This is because your data payload will contain time and you need to specify which field it has to extract the time etc.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...