curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

post(json-splunk-uf): source type can be configured through Splunk Web 

especially for Splunk Cloud that provides no access to props.conf
This commit is contained in:
Ming Di Leom 2023-08-13 07:54:21 +00:00
parent c96f348ca5
commit 67a19d7844
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/_posts/json-splunk-uf.md
View File

@ -2,6 +2,7 @@
title: Configure Splunk Universal Forwarder to ingest JSON files title: Configure Splunk Universal Forwarder to ingest JSON files
excerpt: Parse single-line JSON into separate events excerpt: Parse single-line JSON into separate events
date: 2023-06-17 date: 2023-06-17
updated: 2023-08-13
tags: tags:
- splunk - splunk
--- ---
@ -100,3 +101,5 @@ AUTO_KV_JSON = 0
SHOULD_LINEMERGE = 0 SHOULD_LINEMERGE = 0
# MAX_DAYS_AGO = 3560 # MAX_DAYS_AGO = 3560
``` ```
For Splunk Cloud deployment, the above configuration can only be added through Splunk Web: **Settings > [Source types](https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Managesourcetypes)**.