Trouble indexing Amanda (backup) JSON files into Splunk

[khhenderson]

I have added the following to my props.conf file.

AMANDA JSON FILES

[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = json
Are there more changes that I could make to my props.conf file for better indexing?

The JSON file is indexing but it doesn't look good.
Is there a way to add a timestamp to the file as it's indexed?

[woodcock · Accepted solution]

Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json or KV_MODE = json but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT.

[somesoni2]

Could you post some sample json data?

[khhenderson]

  "output_size" : {
     "incr" : 51188360,
     "total" : 51188360,
     "full" : 0
  },
  "tapedisks" : "",
  "dles_dumped" : {
     "incr" : 4,
     "total" : 4,
     "full" : 0
  },
  "avg_compression" : {
     "incr" : "100.0",
     "total" : "100.0",
     "full" : "100.0"
  },
  "avg_dump_rate" : {
     "incr" : "49580.4",
     "total" : "49580.4",
     "full" : "-- "
  }

},
"summary" : [
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/app-uploads"
},
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/braingames-storage"
},