Getting Data In

Trouble indexing Amanda (backup) JSON files into Splunk

khhenderson
Path Finder

I have added the following to my props.conf file.

AMANDA JSON FILES

[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = json
Are there more changes that I could make to my props.conf file for better indexing?

The JSON file is indexing but it doesn't look good.
Is there a way to add a timestamp to the file as it's indexed?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json or KV_MODE = json but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json or KV_MODE = json but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT.

0 Karma

somesoni2
Revered Legend

Could you post some sample json data?

0 Karma

khhenderson
Path Finder
  "output_size" : {
     "incr" : 51188360,
     "total" : 51188360,
     "full" : 0
  },
  "tapedisks" : "",
  "dles_dumped" : {
     "incr" : 4,
     "total" : 4,
     "full" : 0
  },
  "avg_compression" : {
     "incr" : "100.0",
     "total" : "100.0",
     "full" : "100.0"
  },
  "avg_dump_rate" : {
     "incr" : "49580.4",
     "total" : "49580.4",
     "full" : "-- "
  }

},
"summary" : [
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/app-uploads"
},
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/braingames-storage"
},

0 Karma