Getting Data In

uploading json data file does not get parsed properly

sawgata12345
Path Finder

Hi I tried to upload file in json format but after uploading whole json is showing as single entry and no event getting gerenated from it. What is the correct JSON format for splunk? Is there any special format of JSON that Splunk understands?

0 Karma
1 Solution

sawgata12345
Path Finder

Hi,
I found the answer to my question.
The json file should be in below format
{
"key":"value",
"key2":"value2"
}
{
"key":"value",
"key2":"value2"
}

Just upload the file it will get indexed and search queries also work nicely

View solution in original post

sawgata12345
Path Finder

Hi,
I found the answer to my question.
The json file should be in below format
{
"key":"value",
"key2":"value2"
}
{
"key":"value",
"key2":"value2"
}

Just upload the file it will get indexed and search queries also work nicely

jbarlow_splunk
Splunk Employee
Splunk Employee

no special format. just json

you may need to do INDEXED_EXTRACTIONS = json in props.conf..
per
http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Extractfieldsfromfileswithstructureddat...

there is also search time KV_MODE=json

(but do not set both KV_MODE and INDEXED_EXTRACTIONS ...its an either or,,, will get duplicate fields if both set)
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are your props.conf settings for that sourcetype?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...