Splunk Enterprise

How to write props for JSON logs?

Path Finder

Below is the sample log:

    context: default

     level: INFO

     logger: logginfdata.pre-request.util

    mdc: { [+]


message:  this is a json request


thread: RealtimeExecutor-1999

timestamp: 2022-03-23 15:44:41.965


may i know how can write props for this kind of logs.

Labels (1)
0 Karma



Can you please share a valid JSON sample event? Just copy _raw and mask data with sample values. Now paste it into the code block.  Find this (</>) tool in the toolbar for the code block popup. This will help us to answer you with a proper solution.



Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...