Inputs: HEC JSON-Format: Unterschied zwischen den Versionen

Version vom 13. Mai 2020, 09:33 Uhr

PowerShell to create a JSON-Object and send to Splunk

#Create a PowerShell-Object and convert it to the JSON-Format
$Body = [PSCustomObject]@{
	host = $HVNode.ToUpper()
	event = @{
		<YourFieldName> = <YourValue>
		<YourFieldName> = <YourPowerShell-Command>
	}
} | ConvertTo-Json -Depth 4
 
#Splunk Variables
$SplunkPort = 8088
$SplunkHeader = @{Authorization = "Splunk <Splunk_HEC-Token>"}
$SplunkURL = "http://<Splunk-URL>:$SplunkPort/services/collector/event"
 
#Send the created JSON to the Splunk HEC Input
Invoke-WebRequest -Uri $SplunkURL -Method Post -Body $Body -Headers $SplunkHeader -UseBasicParsing

Splunk configurations

Whether or not the Splunk JSON parser for 'INDEXED_EXTRACTIONS' strips curly braces from names of fields that are defined as arrays in JSON events.
With the Splunk "option" JSON_TRIM_BRACES_IN_ARRAY_NAMES=true you can exclude the curly braces "{}" from array field names.

props.conf

 [qCheck:Compute:JSON]
 JSON_TRIM_BRACES_IN_ARRAY_NAMES = true
 INDEXED_EXTRACTIONS = JSON
 BREAK_ONLY_BEFORE = ^{
 SHOULD_LINEMERGE = true
 TRUNCATE = 500000  

More information's about the props.conf: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf