https://community.splunk.com/t5/Getting-Data-In/How-to-find-non-json-records/m-p/476625#M81819 <P>I have a bunch of sourcetypes which are supposed to contain only valid JSON data. I've been asked to verify that in fact they do contain only json. Is there an easy/elegant way to search to find records which were not well-formed JSON? (ie, records that Splunk can automatically format as a JSON tree.)</P> Wed, 19 Feb 2020 21:41:25 GMT ShagVT 2020-02-19T21:41:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-non-json-records/m-p/476625#M81819 <P>I have a bunch of sourcetypes which are supposed to contain only valid JSON data. I've been asked to verify that in fact they do contain only json. Is there an easy/elegant way to search to find records which were not well-formed JSON? (ie, records that Splunk can automatically format as a JSON tree.)</P> Wed, 19 Feb 2020 21:41:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-non-json-records/m-p/476625#M81819 ShagVT 2020-02-19T21:41:25Z https://community.splunk.com/t5/Getting-Data-In/How-to-find-non-json-records/m-p/476626#M81820 <P>@ShagVT if you know the JSON structure like the root node or some other unique pattern, you can use the same to parse and send unwanted data/events to nullQueue (or a separate index) then you can get stats of events pushed to null queue or separate index/sourcetype. <A href="https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues">https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data_and_send_to_queues</A></P> Thu, 20 Feb 2020 14:10:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-find-non-json-records/m-p/476626#M81820 niketn 2020-02-20T14:10:55Z