Knowledge Management

Onboarding JSON extract

Loves-to-Learn Lots


I am currently onboarding some data from a different instance of Splunk using a REST API call ... The data produced is JSON and it includes, sourcetype, source, host, _time and _raw.

Is there any way I can match the details from the JSON extract to the corresponding fields in my local instance (i.e., source, sourcetype and host)?

How can I also get Splunk to automatically extract the results._raw field? Do I need to create field extraction for all fields?

the event is currently being onboarded like this:

4:15:00.041 AM

{ [-]
offset: 7

preview: false

result: { [-]
_raw: 2019-07-18 02:15:00.041, LONG_RUN_TX="0"

_serial: 3

_si: [ [+]

_sourcetype: sql_x

_subsecond: .041

_time: 2019-07-18 02:15:00.041 GMT

host: SQL01
source: sqlx_extract_log

sourcetype: sqlx_extract



Thank you.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...