Getting Data In

Multiple Json types in one file. How do i get data into Splunk

robertlynch2020
Motivator

Hi

I have one file with multiple JSON types in it.
What is the best way to get this data into Splunk.
I dont think i can use a universal forwarder as i cant specify the sourcetype as i is multiple.

Someone said use a heavy forward and do the work of splitting the data into different source types before i send it.

Is this the correct approach?

Thanks
Robert Lynch

1 Solution

robertlynch2020
Motivator
0 Karma

robertlynch2020
Motivator
0 Karma

starcher
SplunkTrust
SplunkTrust

If the source can be edited to write to different files per sourcetype that is most ideal.

Another option that doesn't involve the universal forwarder is ingest the file using python and send to Splunk HTTP Event collector. A bit more complex but more flexible than doing regex routing at indexers.

0 Karma

niketn
Legend

@robertlynch2020, your indexer can also do this job, but better approach like you have said is to use heavy forward to set different sourcetype based on different JSON from the same source through props.conf and transforms.conf for sourcetype override.

Refer to Splunk Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides#Example:_Assign_...

And Splunk Blog: https://www.splunk.com/blog/2010/02/11/sourcetypes-gone-wild.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

robertlynch2020
Motivator

Hi

Thanks, this is the answer i went with 🙂

0 Karma

splunker12er
Motivator

spath command, it will do that for you, you may refer to the below link for using spath

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/spath

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...