topic Re: How to exclude/ignore writing an error to splunkd.log in Getting Data In

How to exclude/ignore writing an error to splunkd.log

nareshinsvu — Mon, 30 Sep 2019 04:51:22 GMT

Hi,

Is there a way to tell splunk not to write a particular error message to splunkd.log?

I am getting hit by below error continuously and I can't fix JSON inputs which are coming from external source.

My splunkd.log has only these lines and nothing else.

09-30-2019 14:45:25.717 +1000 ERROR JsonLineBreaker - JSON StreamId:10924785040871047960 had parsing error:Unexpected character: '-' - .......................

My props.conf is like

[my_json]
SEDCMD-strip_prefix = s/^[^{]+//g
INDEXED_EXTRACTIONS=JSON
NO_BINARY_CHECK = true
category = Custom
description = my_json_custom
disabled = false
pulldown_type = true
DATETIME_CONFIG = CURRENT
TRUNCATE = 100000
MAX_EVENTS = 10000

Re: How to exclude/ignore writing an error to splunkd.log

gcusello — Mon, 30 Sep 2019 06:57:55 GMT

Hi nareshinsvu,
if you want, you can filter events before indexing (see https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Routeandfilterdatad ) but why you want this?
I think that all the information can be useful to debug a problem when needed, if you want to exclude them fron your searches use a NOT clause in yout search so you can exclude them!

Anyway to filter these events, you can use something like this:
In props.conf

[my_json]
TRANSFORMS-null= setnull

In transforms.conf

[setnull]
REGEX = ERROR JsonLineBreaker - JSON StreamId:\d+ had parsing error:Unexpected character
DEST_KEY = queue
FORMAT = nullQueue

If instead you want to exclude these events from your searches, see something like this:

your_search NOT ("ERROR JsonLineBreaker - JSON StreamId:" "had parsing error:Unexpected character")
| ...

Bye.
Giuseppe

Re: How to exclude/ignore writing an error to splunkd.log

nareshinsvu — Mon, 30 Sep 2019 07:10:16 GMT

Hi Giuseppe,

You got my question wrong. Below is my splunkd.log file on forwarders. Not the source file content being indexed

I am getting these lines in the splunk logs while indexing JSON data (from my source data which is a mix of JSON and non-JSON). I am successfully getting my JSON data indexed. But my splunkd.log is continuously filled with these lines which I want to avoid.

09-30-2019 14:45:25.717 +1000 ERROR JsonLineBreaker - JSON StreamId:10924785040871047960 had parsing error:Unexpected character: '-' - .......................