Getting Data In

search simple json

Loves-to-Learn Lots

I tried many ways to generate a properly formated json for splunk to parse it so i can put some alerts on my data but  no  success yet  , nad the log is really simple 


2021-02-19T18:35:43,878Z [main] INFO dev-AniMatchIngester - { "createTS":"2021-02-19T10:35:43Z", "accountId":"333333", "correlationId":"1112222", "msgType":"raw_published", "Outcome":"Success", "eventOccurrenceTimestamp":"2020-01-14 08:12:07.111", "Type":"TEST", "eventType":"Success" }


I need to i deally want these fields in intresting fields section or at the least i should be able to do a meaning queries based on eventOccurrenceTimestamp  > today etc., or Type =="test" comparisons it was so easy in elk .  

Labels (1)
0 Karma

Ultra Champion
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!