Splunk Enterprise

How to write props for JSON logs?

Vani_26
Path Finder

Below is the sample log:


{[-]
    context: default

     level: INFO

     logger: logginfdata.pre-request.util

    mdc: { [+]

 }

message:  this is a json request

[evenId=76546787678888899999]]

thread: RealtimeExecutor-1999

timestamp: 2022-03-23 15:44:41.965

}

may i know how can write props for this kind of logs.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Vani_26 

Can you please share a valid JSON sample event? Just copy _raw and mask data with sample values. Now paste it into the code block.  Find this (</>) tool in the toolbar for the code block popup. This will help us to answer you with a proper solution.

KV

 

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...