Splunk Search

Is it possible to let splunk recognize fields automatically with this layout

rrovers
Contributor

Hi,

I have a json-file in splunk with an arguments{}-field like this

 

field1=[content_field1] field2=[content_field2] field3=[content_field3] 

 

 

splunk doesn't recognize the fields field1 etc. I assume it is because this is not really json format but I want to be sure.

I can extract the files with rex but if splunk can recognize the fields automatically would be better.

I think the content of the log-file should be something like this:

 

arguments{}:{"field1":"content_field1",
"field2":"content_field2",
"field3:"content_field3"}

 

but I want to be sure if that's the best way (because when it is the logging has to be changed).

Does splunk recognize the fields automatically if events are logged in this way? Is the above mentioned the best way or are there better ways to let splunk recognize the fields automatically?

 

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you want Splunk to extract fields for you then you must use a "standard" format.

By default, Splunk will extract fields from events in key=value format.  Other formats, like CSV, JSON, XML, etc. must be specified in props.conf.  JSON and XML events must be well-formed or Splunk will not extract anything from them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...