topic Re: nodejs SplunkLogger - json message is not parsed in Getting Data In

nodejs SplunkLogger - json message is not parsed

ngoodrich — Wed, 19 Dec 2018 23:32:25 GMT

I am using the manual batching example from the docs.

I am sending the following data to the logger.send function:

const obj = {
      oid: 'bluesun',
      tid: 'transaction_id',
      type: 'error',
      msg: 'I broke something bad'
    }

this.logger.send({
      message: obj,
      metadata: {
        source: 'awsBot',
        sourcetype: 'event-bus'
      },
      severity: 'error'
})

However, none of the fields in the json object appear to be parsed when coming into splunk.

This index is shared by other services that are logging in other formats so we can't override the entire index to expect json formatted messages, but is there a way to force these messages from this source to be parsed as json?

Re: nodejs SplunkLogger - json message is not parsed

sdchakraborty — Thu, 20 Dec 2018 06:20:04 GMT

Hi,

will it be possible for you to make the sourcetype "_json"? That cloud resolve your issue.

Sid

Re: nodejs SplunkLogger - json message is not parsed

ngoodrich — Thu, 20 Dec 2018 16:27:25 GMT

@sdchakraborty That did not work.

Re: nodejs SplunkLogger - json message is not parsed

rohan05 — Mon, 10 Jun 2024 07:20:22 GMT

I am facing the same issue. Not able to see any of the data in splunk. Did you find the solution to get the data?

Please let me know how to resolve this issue.