Splunk Search

How to configure Splunk to extract key value pairs for a particular sourcetype with JSON log data?

clayton_bell_ag
Engager

How do I tell splunk that a particular source_type should have specific extract command parameters applied so as to correctly split the data into key & value? This is for ease of searching by users so that they don't have to know how how to get the fields out: they should just be there ready for them use.

Specifically, I have some simple log files that contain a single line of json text. There is only one level of "key"=>"value" in the file.

eg

{"host"=>"db1.blah", "app"=>"myapp"}

The following extract command (at search time) simply parses the key=>values and makes search time fields out of them.

host=* index=json_logs  | extract kvdelim="=>" pairdelim=","

My question is, how do it tell splunk to automatically kv extract this source type. So that an end user can simply type

host=* index=json_logs | search host=db1.blah

All of our other indexes have search time extractions via regexes and our users are used to simply getting the data in a format that is pre-field-extracted as much as possible. So they can focus on the problem and less on the parsing.

Thanks for considering this problem.

1 Solution

cpetterborg
SplunkTrust
SplunkTrust

In your props.conf file for this log data, set something like the following:

[mysourcetype]
KV_MODE = json

This should automatically extract all the fields for you because you are telling it that the type of data is json, which will trigger the extraction for you.

View solution in original post

cpetterborg
SplunkTrust
SplunkTrust

In your props.conf file for this log data, set something like the following:

[mysourcetype]
KV_MODE = json

This should automatically extract all the fields for you because you are telling it that the type of data is json, which will trigger the extraction for you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...