Splunk Search

How to configure timestamp recognition for JSON data inputs?

ronak
Path Finder

Hi

Until now, I had comma separated text inputs from many of my sources. Using props.conf, I could define the timestamp (e.g. which position and look ahead etc).

However, I anticipate JSON data inputs very shortly. I'm not sure what would be the steps/process to be able to specify timestamp (i.e. which time component to use for associating with searches)

Any pointers would be greatly appreciated

thanks, ronak

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

@ronak you can use INDEXED_EXTRACTIONS = JSON for accomplishing this

INDEXED_EXTRACTIONS = < CSV|W3C|TSV|PSV|JSON >
* Tells Splunk the type of file and the extraction and/or parsing method Splunk should use
on the file.
CSV - Comma separated value format
TSV - Tab-separated value format
PSV - pipe "|" separated value format
W3C - W3C Extended Extended Log File Format
JSON - JavaScript Object Notation format
* These settings default the values of the remaining settings to the
appropriate values for these known formats.
* Defaults to unset.

in props.conf on the UF set in $SPLUNK_HOME/etc/system/local/props.conf:

[your_sourcetype]
INDEXED_EXTRACTIONS = JSON
KV_MODE = none

restart splunk
$SPLUNK_HOME/bin
./splunk restart

http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Extractfieldsfromfileheadersatindextime

aweitzman
Motivator

Shouldn't be any different. Regex is still regex.

Unless your new inputs are multiple lines per event. Then you might have to do some work to combine them into a single event, but even then, you should still be able to regex your timestamp out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...