I have added the following to my props.conf file.
[amanda]
INDEXED_EXTRACTIONS = json
KV_MODE = json
Are there more changes that I could make to my props.conf file for better indexing?
The JSON file is indexing but it doesn't look good.
Is there a way to add a timestamp to the file as it's indexed?
Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json
or KV_MODE = json
but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT
.
Even though your question is vague ("doesn't look good", "better indexing"), I will give you some specific advice. Use either INDEXED_EXTRACTIONS = json
or KV_MODE = json
but not both. Try each to see which you like better. The former has to be deployed to the Forwarder and splunk has to be restarted but the latter goes to the Search Head. You do not need to add a timestamp to the file, just use DATETIME_CONFIG = CURRENT
.
Could you post some sample json data?
"output_size" : {
"incr" : 51188360,
"total" : 51188360,
"full" : 0
},
"tapedisks" : "",
"dles_dumped" : {
"incr" : 4,
"total" : 4,
"full" : 0
},
"avg_compression" : {
"incr" : "100.0",
"total" : "100.0",
"full" : "100.0"
},
"avg_dump_rate" : {
"incr" : "49580.4",
"total" : "49580.4",
"full" : "-- "
}
},
"summary" : [
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/app-uploads"
},
{
"tape_duration" : 0,
"backup_level" : "",
"hostname" : "lbackup-i1.ourdomain.com",
"dump_orig_kb" : "",
"dump_timestamp" : null,
"dump_duration" : 0,
"dump_comp" : "",
"dump_out_kb" : "",
"last_tape_label" : null,
"dle_status" : "nodump-FAILED",
"configuration_id" : 1,
"tape_rate" : "",
"dump_partial" : "",
"dump_rate" : "",
"disk_name" : "/mnt/braingames-storage"
},