Knowledge Management

Onboarding JSON extract

Loves-to-Learn Lots


I am currently onboarding some data from a different instance of Splunk using a REST API call ... The data produced is JSON and it includes, sourcetype, source, host, _time and _raw.

Is there any way I can match the details from the JSON extract to the corresponding fields in my local instance (i.e., source, sourcetype and host)?

How can I also get Splunk to automatically extract the results._raw field? Do I need to create field extraction for all fields?

the event is currently being onboarded like this:

4:15:00.041 AM

{ [-]
offset: 7

preview: false

result: { [-]
_raw: 2019-07-18 02:15:00.041, LONG_RUN_TX="0"

_serial: 3

_si: [ [+]

_sourcetype: sql_x

_subsecond: .041

_time: 2019-07-18 02:15:00.041 GMT

host: SQL01
source: sqlx_extract_log

sourcetype: sqlx_extract



Thank you.

Tags (1)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!