×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
fatemebayat
Engager
Member since: ‎05-23-2017
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 1
Member Since ‎05-23-2017
Activity Feed
View All

Re: json sourcetype failed to act correctly

by in Deployment Architecture
‎05-24-2017 05:33 AM
1 Karma
‎05-24-2017 05:33 AM
1 Karma
hi hettervi thanks for your attention. yes, in know it :). sourcetype is _json. finally i solved it. in setting -> source types -> _json, i added below setting. -SHOULD_LINEMERGE= false -AUTO_KV_JSON = false -KV_MODE = none and timestamp in auto mode and has a structure like this (Wed May 24 09:30:00.555 UTC 2017). ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma from
View All