What are the steps to configure Splunk to parse and index JSON data?

[chaseto]

Hello Experts,

I am very new to Splunk. I can import data into Splunk from .csv file by:
add data->select source->sourcetype(access_combined)->next and click save.
I can view the data by searching by giving the correct index and source name.

In the same way, what is the process for JSON data? Can anyone explain me the detail steps of it starting from the props.conf?

Below is the sample data which I have

{"version":"2.4","user":{"zipCode":"","pcnNumber":""},"event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"},"productInfo":[{"productName":"DeltaGold","pmc":"113"}]}],"page":{"attributes":{"rbpnIndicator":"","preApproval":"NPA","appCache":"","appType":"Co-Brand","channel":"Non-DTW","rwd":"desktop","appConfig":"","experience":"Microsite","partner":"dal","acqCardType":"CCSG","appDecision":"","partnerAppType":"Co-Brand","acqExperience":"Microsite","productInfo":[{"productName":"DeltaGold","pmc":"113"}],"applicationId":"CPI_WEB","formName":"appForm","tool":"","autotrack":false,"appLength":"Long","decisionIndicator":"","flowType":"Prospect","sid":"2s0Hfr1lhsBhm8ad3hw01C2"},"pageInfo":{"country":"US","language":"en","pageID":"ng31hcrmnnh11zp","pageName":"DeltaGold_StartApp"},"category":{"primaryCategory":"Acq","subCategory1":"CCSG","subCategory2":"Microsite","businessUnit":"AMEX","subCategory3":"CPI"}}}

In the above data, do I get a separate field for each separated by semicolon and separate fields for the one which are there in the flower brackets?
example: "event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"}

Sorry for such a big question and thank you in advance

[pramit46]

I would add the following line under the respective sourcetype stanza.

kv_mode=json

or use spath in the query.

[mkemmerer]

spath is probably going to work best since you've got arrays in your data. Searching through arrays of objects can get a bit ugly in my experience.

[chaseto]

so are you saying once the data is in splunk, instead of regurlar search using spath gives a clear picture..right?

[sundareshr]

Here are a couple of links that may help

https://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html

https://kzhendev.wordpress.com/2015/01/19/consuming-json-with-splunk-in-two-simple-steps/

[chaseto]

Thank You for the response .I figured how the process is done,on the other side I want know does it have seperate fields for the one which is in the flower brackets

"event":[{"eventInfo":{"eventAction":"start","eventType":"cardApplication"}

like eventAction and eventType in two different fields.