Getting Data In

Query to be auto applied

Karthikeya
Communicator

Hello,

We have json data coming in Splunk and to extract that we have given

| rex "(?<json>\{.*\})"

| spath input=json

Now my ask is I want this query to be run by default for one or more sourcetypes, without everytime giving in search query.

Do I need to do it while on boarding itself only? If yes please help me with step by step procedure. We don't have HF. We have deployment server, manager, and 3 indexers. DS will push apps to manager and from there manager will push apps to peers.

0 Karma
1 Solution

mattymo
Splunk Employee
Splunk Employee

yes it can. and no it wont. because you wont be extracting fields at index time if you dont use indexed_extractions=json. 

Splunk is very good at applying only what config matters. So when in doubt send them to both idx and sh. Splunk usually just figures it out. 

The duplicate extractions issues happens when you do BOTH index time (indexed_extractions=json) AND Search time (kv_mode=json) in your props.conf config. Thats when they may collide, and is why i say i ALMOST never enable indexed_extractions=json as I would always prefer review of search time extract then only move key fields i need to index time for performance reasons. 

- MattyMo

View solution in original post

0 Karma

mattymo
Splunk Employee
Splunk Employee

Simplest way to put it...create a single app with all your sourcetype configs in it, then distribute that app using the appropriate mechanism for 1. indexers (manager node) 2. Search heads (deployer for SHC or DS/Directly, if standalone) 

- MattyMo
0 Karma

Karthikeya
Communicator

Ok here my doubt is... Can one app which contains props.conf (with kv_mode=json) be distributed to both indexers and search heads? Because will it may lead to duplication of fields or events by any chance? Index time and search time extraction I am asking about. Is it ok?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Karthikeya ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

mattymo
Splunk Employee
Splunk Employee

yes it can. and no it wont. because you wont be extracting fields at index time if you dont use indexed_extractions=json. 

Splunk is very good at applying only what config matters. So when in doubt send them to both idx and sh. Splunk usually just figures it out. 

The duplicate extractions issues happens when you do BOTH index time (indexed_extractions=json) AND Search time (kv_mode=json) in your props.conf config. Thats when they may collide, and is why i say i ALMOST never enable indexed_extractions=json as I would always prefer review of search time extract then only move key fields i need to index time for performance reasons. 

- MattyMo
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...