Splunk Enterprise

How to write props for JSON logs?

Vani_26
Path Finder

Below is the sample log:


{[-]
    context: default

     level: INFO

     logger: logginfdata.pre-request.util

    mdc: { [+]

 }

message:  this is a json request

[evenId=76546787678888899999]]

thread: RealtimeExecutor-1999

timestamp: 2022-03-23 15:44:41.965

}

may i know how can write props for this kind of logs.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Vani_26 

Can you please share a valid JSON sample event? Just copy _raw and mask data with sample values. Now paste it into the code block.  Find this (</>) tool in the toolbar for the code block popup. This will help us to answer you with a proper solution.

KV

 

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...