Hi everyone, In my inputs.conf I am monitoring a fifo file receiving json events. Inputs.conf : [fifo:///tmp/a.fifo] disabled=0 index=main sourcetype=json_test Props.conf : [json_test] INDEXED_EXTRACTIONS=JSON KV_MODE=none AUTO_KV_JSON=false SHOULD_LINEMERGE=false TIME_FORMAT=%s.%6N I see that all fields are parsed correctly, yet I cannot tstats by none metadata fields. I then tried to add TRANSFORMS-js=test_js to props.conf and have the following stanza in transforms.conf : [test_js] REGEX=\"([a-zA-Z0-9_.]+)\":\"([^"]+)\" FORMAT=$1::$2 REPEAT_MATCH=true WRITE_META=true In this case, I am able to tstats on some json fields. However, this regex does not cover all cases of keys and values of a json line and it seems very redundant to reparse all json fields after INDEXED_EXTRACTIONS=json. Any ideas on how to solve this issue ? ... View more

Hi there, I have a CSV file with 2 fields : time,xml_data. Is there anyway I can parse the xml_data field as XML ? This is a nested XML inside a CSV field and I would prefer to parse it on index time (if not, parsing on search time is also acceptable). Thanks ... View more

Hello, We are trying to index long JSON files. Each JSON file is one event. As performance is more important to us than storage space, we wish to extract all JSON fields at index-time. We tried to use the INDEXED_EXTRACTIONS=JSON configuration, but it seems that it does not extract all the available JSON fields (For example, there are many fields missing from the "Interesting Fields" section). We conducted some tests, and were successful in extracting ALL fields using KV_MODE=JSON , but it's no good for us because of the aforementioned performance issues. How can we make Splunk indexer extract all fields during index-time? Are we missing some kind of configuration regarding the depth of the JSON? Thanks ... View more

Hello, In our use of Splunk we have encountered several problems in JSON indexing that caused to upgrade our Splunk servers. We are trying to index large JSON files. the problem that we’ve encountered is that splunk indexer isn't extracting all the fields from the JSON file, the symptoms of our problems are: 1. if we execute the "|table field_name" we don't get the value of the filed 2. if we execute the "|spath field_name |table field_name" somtimes we get the value twice. 3. we don't see the filed in the "field table" on the left to the events in the search app. In the new version of Splunk (6.2.4) we’ve noticed that there are two options to extract the data fields from the JSON files. The first one is INDEXED_EXTRACTIONS and the second one is KV_MODE. I would appreciate your help to understand which way is better to improve the search time when we are looking for a value of a field in the json as: index=index_name field_name="value" and to solve the problems described above. Thanks ... View more

Hi, I'm using splunk for few weeks and its seems really great but recently i had some issue with one of the needs in a new project. My target is to perform indexing and searching by tag inside XML Files within the following format value value value xxxxz ceijciejci I have no idea what will be the inner fields and how deep will they go. a success would be for me a way to index everything by key-Value so i could search any of the keys and get all matching object with proper value within them. my senses tells me i need to write some generic regex for this so thats what i did: LINE_BREAKER=(<FileItem>.*?/) ### Object Bounderis REGEX = <(?<_KEY_1>.+?)>(?<_VAL_1>.+?)<\/.+?> ### Generic Key-Value Indexer its working really nice but there is one issue. when i have 2 duplicate key with the same name and different value its seems like splunk takes only the first one of them [for example if i search Blabla=xxxxz it wont return any results] is there any way to do it better and solve my issue? Thanks. :) ... View more