From 67a19d78447250b725ff547bdc3fdf005e5a01e7 Mon Sep 17 00:00:00 2001
From: Ming Di Leom <2809763-curben@users.noreply.gitlab.com>
Date: Sun, 13 Aug 2023 07:54:21 +0000
Subject: [PATCH] post(json-splunk-uf): source type can be configured through
 Splunk Web

especially for Splunk Cloud that provides no access to props.conf
---
 source/_posts/json-splunk-uf.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/source/_posts/json-splunk-uf.md b/source/_posts/json-splunk-uf.md
index e66caef..b76e7a6 100644
--- a/source/_posts/json-splunk-uf.md
+++ b/source/_posts/json-splunk-uf.md
@@ -2,6 +2,7 @@
 title: Configure Splunk Universal Forwarder to ingest JSON files
 excerpt: Parse single-line JSON into separate events
 date: 2023-06-17
+updated: 2023-08-13
 tags:
   - splunk
 ---
@@ -100,3 +101,5 @@ AUTO_KV_JSON = 0
 SHOULD_LINEMERGE = 0
 # MAX_DAYS_AGO = 3560
 ```
+
+For Splunk Cloud deployment, the above configuration can only be added through Splunk Web: **Settings > [Source types](https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Managesourcetypes)**.