- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Modify json structure for sourcetype that has indexed_extractions=json
We have a single Splunk instance with custom scripted input that pulls down json, and has indexed extractions.
New fields were added to the json that aren't getting extracted. We want to be able to remove the known headers that Splunk knows of (what fields to extract), so that it can start over and pick up newly added fields. Is there any method of doing this?
Are our only options: 1) change sourcetype or 2) use search time extractions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It does not work like that. Splunk does not cache headers for INDEXED_EXTRACTIONS. If it seems to be doing so, try deleting the file so that it is rewritten with a fresh header line.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The file that you are monitoring in your inputs.conf:
[monitor:///Your/Path/To/YourFileHere]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
All I can find in the docs is:
https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata
No support for mid-file renaming of header fields
Some software, such as Internet Information Server, supports the renaming of header fields in the middle of the file. Splunk software does not recognize changes such as this. If you attempt to index a file that has header fields renamed within the file, the renamed header field is not indexed.
