Getting Data In

Modify json structure for sourcetype that has indexed_extractions=json

hortonew
Builder

We have a single Splunk instance with custom scripted input that pulls down json, and has indexed extractions.

New fields were added to the json that aren't getting extracted. We want to be able to remove the known headers that Splunk knows of (what fields to extract), so that it can start over and pick up newly added fields. Is there any method of doing this?

Are our only options: 1) change sourcetype or 2) use search time extractions?

0 Karma

woodcock
Esteemed Legend

It does not work like that. Splunk does not cache headers for INDEXED_EXTRACTIONS. If it seems to be doing so, try deleting the file so that it is rewritten with a fresh header line.

0 Karma

hortonew
Builder

Which file?

0 Karma

woodcock
Esteemed Legend

The file that you are monitoring in your inputs.conf:

[monitor:///Your/Path/To/YourFileHere]
0 Karma

hortonew
Builder

All I can find in the docs is:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata
No support for mid-file renaming of header fields
Some software, such as Internet Information Server, supports the renaming of header fields in the middle of the file. Splunk software does not recognize changes such as this. If you attempt to index a file that has header fields renamed within the file, the renamed header field is not indexed.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...