Splunk Enterprise

How to write props for JSON logs?

Vani_26
Path Finder

Below is the sample log:


{[-]
    context: default

     level: INFO

     logger: logginfdata.pre-request.util

    mdc: { [+]

 }

message:  this is a json request

[evenId=76546787678888899999]]

thread: RealtimeExecutor-1999

timestamp: 2022-03-23 15:44:41.965

}

may i know how can write props for this kind of logs.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Vani_26 

Can you please share a valid JSON sample event? Just copy _raw and mask data with sample values. Now paste it into the code block.  Find this (</>) tool in the toolbar for the code block popup. This will help us to answer you with a proper solution.

KV

 

Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...