Getting Data In

When I search for _json sourcetype, I am not getting the results as highlighted

mintughosh
Path Finder

When I search for _json sourcetype, I am not getting the results as highlighted like json sourcetype should have been, I tried the following options on props.conf in Heavy forwarder where the Rest API modular input is installed

[_json]
kv_store = JSON
Index_extractions = json

I have tried all the above options but still not working

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mintughosh,

is this a typo kv_store = JSON?

You should either use KV_MODE = json which is a search time setting on the search head
OR
INDEXED_EXTRACTIONS = JSON on your input instance, see the docs for more details http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline#S...

Hope this helps ...

cheers, MuS

0 Karma

mintughosh
Path Finder

yes, that was a typo. Ok. I wil try to make the changes on the Search head clusters and see if it works

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!