What is the best and reliable way to do the field extraction in Splunk and data ingested is in json format?

[manjunath_n]

Hello,

We are in need of field extractions in Splunk.

What is the best and reliable way to do the field extraction in Splunk and data ingested is in json format. 

Please let us know if there is any way to do the extractions during ingestion so that it gets auto extracted and by searching index=sample sourcetype=json we could get them as fields under the interesting fields.

Can this be done by editing the props.conf file? Please do provide some examples which would of great help.

Thanks.

[PickleRick]

There are at least three different ways to handle json data.

One is indexed extraction https://docs.splunk.com/Documentation/SplunkCloud/8.2.2112/Data/Extractfieldsfromfileswithstructured...

Another one is automatic json extraction in search-time (KV_MODE=json)

And yet another one is manual use of the spath command.

Every one of them has its pros and cons so you can't, without knowing additional constraints, tell which one is "the best and reliable".