Getting Data In

Indexing JSON

pwjones89
Engager

I am trying to index 555 JSON files accumulating to 293MB.
My inputs.conf is directed at the directory, assigned to the correct index established in indexes.conf, and sourcetype established in props.conf. Props.conf additionally contains KV_MODE = json and TRUNCATE=0. All these configurations have worked on a previous implementation of this setup on a different system.
Ultimately the files are recognised under the data inputs view in Splunk, however the index registers 0 events.
As mentioned, these settings worked in a previous implementation on a different system.
Wondering if anyone has come across similar issues, whether it is with file sizes or JSON implementation itself.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

Simply read the splunkd.log for details.

They may be considered as already indexed, if they have identical first 256 chars.
if this is case, try the crcSalt= in inputs.conf

see http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/HowLogFileRotationIsHandled

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...