Hello,
I need to read the json data into the Splunk. I use the Webtools |curl for that. However at the moment I do not have access to the data from Splunk, but what I have is the data in the json form in the file.
In the meantime until I get the proper access to the data per |curl, I would like to start already with writing the SPL processing it and for that I would like to read it from the file.
How would I do it? How would I read the datafile in json format that I get it in one single field in Splunk, like _raw? From there I could pick it and manipulate further with spath. I do not really want to index the file, I would just like to read it into a single field, that I have the same starting situation as with the curl call.
Is it possible?
Kind regards,
Kamil
