Getting Data In

Modify json structure for sourcetype that has indexed_extractions=json

hortonew
Builder

We have a single Splunk instance with custom scripted input that pulls down json, and has indexed extractions.

New fields were added to the json that aren't getting extracted. We want to be able to remove the known headers that Splunk knows of (what fields to extract), so that it can start over and pick up newly added fields. Is there any method of doing this?

Are our only options: 1) change sourcetype or 2) use search time extractions?

0 Karma

woodcock
Esteemed Legend

It does not work like that. Splunk does not cache headers for INDEXED_EXTRACTIONS. If it seems to be doing so, try deleting the file so that it is rewritten with a fresh header line.

0 Karma

hortonew
Builder

Which file?

0 Karma

woodcock
Esteemed Legend

The file that you are monitoring in your inputs.conf:

[monitor:///Your/Path/To/YourFileHere]
0 Karma

hortonew
Builder

All I can find in the docs is:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata
No support for mid-file renaming of header fields
Some software, such as Internet Information Server, supports the renaming of header fields in the middle of the file. Splunk software does not recognize changes such as this. If you attempt to index a file that has header fields renamed within the file, the renamed header field is not indexed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...