Security

What is the best and reliable way to do the field extraction in Splunk and data ingested is in json format?

manjunath_n
Engager

Hello,

We are in need of field extractions in Splunk.

What is the best and reliable way to do the field extraction in Splunk and data ingested is in json format. 

Please let us know if there is any way to do the extractions during ingestion so that it gets auto extracted and by searching index=sample sourcetype=json we could get them as fields under the interesting fields.

Can this be done by editing the props.conf file? Please do provide some examples which would of great help.

Thanks.

 

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

There are at least three different ways to handle json data.

One is indexed extraction https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Data/Extractfieldsfromfileswithstructured...

Another one is automatic json extraction in search-time (KV_MODE=json)

And yet another one is manual use of the spath command.

Every one of them has its pros and cons so you can't, without knowing additional constraints, tell which one is "the best and reliable".

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...