Getting Data In

read json file in the _raw field



I need to read the json data into the Splunk. I use the Webtools |curl for that. However at the moment I do not have access to the data from Splunk, but what I have is the data in the json form in the file.

In the meantime until I get the proper access to the data per |curl, I would like to start already with writing the SPL processing it and for that I would like to read it from the file.

How would I do it? How would I read the datafile in json format that I get it in one single field in Splunk, like _raw? From there I could pick it and manipulate further with spath. I do not really want to index the file, I would just like to read it into a single field, that I have the same starting situation as with the curl call.

Is it possible?

Kind regards,


Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.