Splunk Search

Suitable Sourcetype for uploading a file in json format

dinaabdelhakam
Path Finder

Hello, I am parsing a file in JSON format to splunk entrprise but the sourcetype is not selected automatically, when I chose JSON sourcetype manually the events doesn't parsed correctly, In addition to I put the file in a JSON validator and the result was that the JSON format is valid so what is the problem then ?

Tags (1)
0 Karma

harsmarvania57
Ultra Champion

Hi,

Can you please let us know how are you ingesting file into Splunk? If Universal Forwarder is sending JSON logfile to Splunk Indexer then try to put below configuration on Universal Forwarder and restart splunk on UF.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...