Getting Data In

Start sending events in JSON format with pre existing raw events

abdalhadi_altin
New Member

Hi,

We are using Splunk Enterprise v 6.6.3. All our indexed events are raw events (logs) and we are planning to use Splunk HEC and send the events in JSON format.

My question: does sending the new events in JSON format affect everything that we have today in Splunk?

0 Karma

DMohn
Motivator

No, new events will not effect what has been indexed already.

However, you will have to consider the following:
If you index your new events with a new sourcetype (which you should so, as field extractions etc will be different for the JSON format), you may have to adapt your already existing searches (reports, dashboards, ...) to also include new data. If the data fields are still identical, you may just go for a index=yourdata sourcetype=oldsourcetype OR sourcetype=newsourcetype - ideally everything will still work.

0 Karma

vinod94
Contributor

Hi @abdalhadi_altinawi ,

Ideally, it should not affect your indexed data...only the fresh events get affected.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...