Splunk | Create your data source
Create a custom data source to support the Splunk Perfecto Connector library.
When submitting data to the HEC and using JSON as the data source, the fields of the JSON file are not extracted and mapped by Splunk. You can correct this issue by defining a custom data source that will automatically handle the extraction of the fields. This data source configuration was found on the GitHub page here, and we were able to leverage this to accommodate our process.
To set up the data source:
-
Click Settings and then Source types.
-
Click New Source Type.
-
Set the Name and Description of the Source Type and change the Index Extractions to json.
-
Select Advanced and then add New Settings.
-
Add 3 new settings that match the ones in the following table.
Name
Value
EXTRACT-
QUOTED-KVPS
(?:\\r\\n)?(?:\\n)?(?:\\t)?(?<_KEY_1>[a-zA-Z
0-9._]+)=\\\"(?<_VAL_1>[A-Z0-9_\s:;!@#$%^&*()\/[\]{}|+.~,'\-]+)\\\"
EXTRACT-UNQUOT
ED-KVPS
(?:\\r\\n)?(?:\\n)?(?:\\t)?(?<_KEY_2>[a-zA-Z0-9._]+)=(?<_VAL_2>[a-zA-Z0-9_:;!@
#$%^&*()\/[\]{}|+.~'\-]+)
KV_MODE
json
-
Click Save.