How to configure Splunk to extract key value pairs for a particular sourcetype with JSON log data?

[clayton_bell_ag]

How do I tell splunk that a particular source_type should have specific extract command parameters applied so as to correctly split the data into key & value? This is for ease of searching by users so that they don't have to know how how to get the fields out: they should just be there ready for them use.

Specifically, I have some simple log files that contain a single line of json text. There is only one level of "key"=>"value" in the file.

eg

{"host"=>"db1.blah", "app"=>"myapp"}

The following extract command (at search time) simply parses the key=>values and makes search time fields out of them.

host=* index=json_logs  | extract kvdelim="=>" pairdelim=","

My question is, how do it tell splunk to automatically kv extract this source type. So that an end user can simply type

host=* index=json_logs | search host=db1.blah

All of our other indexes have search time extractions via regexes and our users are used to simply getting the data in a format that is pre-field-extracted as much as possible. So they can focus on the problem and less on the parsing.

Thanks for considering this problem.

[cpetterborg · Accepted solution]

In your props.conf file for this log data, set something like the following:

[mysourcetype]
KV_MODE = json

This should automatically extract all the fields for you because you are telling it that the type of data is json, which will trigger the extraction for you.