Parse Splunk for Splunk Observability
A log parser for Splunk to Splunk observability.
Included Processors
1
Filter by Condition - Include JSON
Including only messages that have a JSON log body.
2
Parse JSON
Parses a JSON object from the log body and creates new fields for each key in the JSON object.
3
Parse Severity
Apply severity level to logs based on mapping of 1xx, 2xx, 3xx, 4xx and 5xx message.
4
Parse Timestamp
Converts the extracted timestamp string into a proper timestamp format. This processor takes the 'timestamp' field and converts it into a valid timestamp in the log body.