Getting Data In

json kvm_mode and additional transforms

PickleRick
SplunkTrust
SplunkTrust

Please confirm/deny something for me because it's not clear from the docs.

Let's assume I have events containing both "unstructured" data and json. Something similar to the ones from https://community.splunk.com/t5/Getting-Data-In/JSON-transformations/m-p/370127#M67168

Dec 1 22:29:42 127.0.0.1 1 2017-12-01 LOGSERVER 1292 - - {"event_type":"type_here","ipv4":"127.0.0.1","hostname":"pc_name.local","occured":"01-Dec-2017 22:24:34"}

If I set KV_MODE=json, I assume the fields from the json part should get parsed automaticaly. But what about the rest of the message? Can I still apply transforms to get additional fields parsed from the event?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Furthermore, do I understand properly that KV_MODE=json would be applied in search-time. So if I want to additionaly manipulate - for example - time and host which are indexed fields I'd have to make an app affecting ingest-time as well? So I'd need to have both search-time configuration on search-head(s) and ingest-time extractions on heavy-forwarder(s)?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...