How do I tell splunk that a particular source_type should have specific extract command parameters applied so as to correctly split the data into key & value? This is for ease of searching by users so that they don't have to know how how to get the fields out: they should just be there ready for them use.
Specifically, I have some simple log files that contain a single line of json text. There is only one level of "key"=>"value" in the file.
eg
{"host"=>"db1.blah", "app"=>"myapp"}
The following extract command (at search time) simply parses the key=>values and makes search time fields out of them.
host=* index=json_logs | extract kvdelim="=>" pairdelim=","
My question is, how do it tell splunk to automatically kv extract this source type. So that an end user can simply type
host=* index=json_logs | search host=db1.blah
All of our other indexes have search time extractions via regexes and our users are used to simply getting the data in a format that is pre-field-extracted as much as possible. So they can focus on the problem and less on the parsing.
Thanks for considering this problem.
In your props.conf file for this log data, set something like the following:
[mysourcetype]
KV_MODE = json
This should automatically extract all the fields for you because you are telling it that the type of data is json, which will trigger the extraction for you.
In your props.conf file for this log data, set something like the following:
[mysourcetype]
KV_MODE = json
This should automatically extract all the fields for you because you are telling it that the type of data is json, which will trigger the extraction for you.