<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Parser Error in HttpEventCollector in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Parser-Error-in-HttpEventCollector/m-p/407843#M72324</link>
    <description>&lt;P&gt;Hi Team,&lt;/P&gt;

&lt;P&gt;We are using httpevent collector to extract the data from boomerang.js.&lt;BR /&gt;
In recent days, we are receiving "Parser Error(per-token parser errors due to incorrectly formatted event data)" in HttpEventCollector because of which we are facing raid decrease in transaction count.&lt;/P&gt;

&lt;P&gt;Please find the data which we found in _introspection index below.&lt;/P&gt;

&lt;P&gt;Kindly help me to resolve this parser error.&lt;/P&gt;

&lt;P&gt;{   [-] &lt;BR /&gt;
     component:  HttpEventCollector &lt;BR /&gt;
     data:  {   [-] &lt;BR /&gt;
         format:     json&lt;BR /&gt;&lt;BR /&gt;
         num_of_errors:  0&lt;BR /&gt;&lt;BR /&gt;
         num_of_events:  571&lt;BR /&gt;&lt;BR /&gt;
         &lt;STRONG&gt;num_of_parser_errors:     16&lt;/STRONG&gt;&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests:    569&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests_in_mint_format:     0&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests_to_disabled_token:  0&lt;BR /&gt;&lt;BR /&gt;
         series:     http_event_collector_token &lt;BR /&gt;
         token_name:     boomerang&lt;BR /&gt;&lt;BR /&gt;
         total_bytes_indexed:    1706492&lt;BR /&gt;&lt;BR /&gt;
         total_bytes_received:   1703200&lt;BR /&gt;&lt;BR /&gt;
         transport:  http&lt;BR /&gt;&lt;BR /&gt;
    }&lt;BR /&gt;&lt;BR /&gt;
     datetime:   05-23-2018 20:35:39.906 +1000&lt;BR /&gt;&lt;BR /&gt;
     log_level:  INFO&lt;BR /&gt;&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 19:36:58 GMT</pubDate>
    <dc:creator>sujith_usha_kum</dc:creator>
    <dc:date>2020-09-29T19:36:58Z</dc:date>
    <item>
      <title>Parser Error in HttpEventCollector</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parser-Error-in-HttpEventCollector/m-p/407843#M72324</link>
      <description>&lt;P&gt;Hi Team,&lt;/P&gt;

&lt;P&gt;We are using httpevent collector to extract the data from boomerang.js.&lt;BR /&gt;
In recent days, we are receiving "Parser Error(per-token parser errors due to incorrectly formatted event data)" in HttpEventCollector because of which we are facing raid decrease in transaction count.&lt;/P&gt;

&lt;P&gt;Please find the data which we found in _introspection index below.&lt;/P&gt;

&lt;P&gt;Kindly help me to resolve this parser error.&lt;/P&gt;

&lt;P&gt;{   [-] &lt;BR /&gt;
     component:  HttpEventCollector &lt;BR /&gt;
     data:  {   [-] &lt;BR /&gt;
         format:     json&lt;BR /&gt;&lt;BR /&gt;
         num_of_errors:  0&lt;BR /&gt;&lt;BR /&gt;
         num_of_events:  571&lt;BR /&gt;&lt;BR /&gt;
         &lt;STRONG&gt;num_of_parser_errors:     16&lt;/STRONG&gt;&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests:    569&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests_in_mint_format:     0&lt;BR /&gt;&lt;BR /&gt;
         num_of_requests_to_disabled_token:  0&lt;BR /&gt;&lt;BR /&gt;
         series:     http_event_collector_token &lt;BR /&gt;
         token_name:     boomerang&lt;BR /&gt;&lt;BR /&gt;
         total_bytes_indexed:    1706492&lt;BR /&gt;&lt;BR /&gt;
         total_bytes_received:   1703200&lt;BR /&gt;&lt;BR /&gt;
         transport:  http&lt;BR /&gt;&lt;BR /&gt;
    }&lt;BR /&gt;&lt;BR /&gt;
     datetime:   05-23-2018 20:35:39.906 +1000&lt;BR /&gt;&lt;BR /&gt;
     log_level:  INFO&lt;BR /&gt;&lt;BR /&gt;
}&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 19:36:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parser-Error-in-HttpEventCollector/m-p/407843#M72324</guid>
      <dc:creator>sujith_usha_kum</dc:creator>
      <dc:date>2020-09-29T19:36:58Z</dc:date>
    </item>
    <item>
      <title>Re: Parser Error in HttpEventCollector</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Parser-Error-in-HttpEventCollector/m-p/407844#M72325</link>
      <description>&lt;P&gt;Sujith, I have same error in Splunk logs in our log now, can you give us your thoughts and the approach that you gave to investigate the issue which will help me to avoid redoing the work. How did you solve it can you share me your approach  &lt;/P&gt;</description>
      <pubDate>Wed, 03 Oct 2018 18:41:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Parser-Error-in-HttpEventCollector/m-p/407844#M72325</guid>
      <dc:creator>sgadmin9997</dc:creator>
      <dc:date>2018-10-03T18:41:18Z</dc:date>
    </item>
  </channel>
</rss>

