Query to be auto applied

[Karthikeya]

Hello,

We have json data coming in Splunk and to extract that we have given

| rex "(?<json>\{.*\})"

| spath input=json

Now my ask is I want this query to be run by default for one or more sourcetypes, without everytime giving in search query.

Do I need to do it while on boarding itself only? If yes please help me with step by step procedure. We don't have HF. We have deployment server, manager, and 3 indexers. DS will push apps to manager and from there manager will push apps to peers.

[gcusello]

Hi @Karthikeya ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[mattymo · Accepted solution]

yes it can. and no it wont. because you wont be extracting fields at index time if you dont use indexed_extractions=json. 

Splunk is very good at applying only what config matters. So when in doubt send them to both idx and sh. Splunk usually just figures it out. 

The duplicate extractions issues happens when you do BOTH index time (indexed_extractions=json) AND Search time (kv_mode=json) in your props.conf config. Thats when they may collide, and is why i say i ALMOST never enable indexed_extractions=json as I would always prefer review of search time extract then only move key fields i need to index time for performance reasons.