UFW parsing JSON ERROR

bardill — Wed, 21 Jul 2021 14:11:19 GMT

After we upgraded from 7.3 to 8.1.4, the UF can no longer read the json data.
07-21-2021 16:03:02.643 +0200 ERROR JsonLineBreaker - JSON StreamId:427620843244980635 had parsing error:Unexpected character while expecting ':': 'S' - data_source="/opt/uc4/srvavq/prod/share/ae/temp/toSplunk/OPT_REP/normal/ARIZON_CS_UC4_ActiveSchedJobs/P_AVQ_Aktive_Automic_Jobs_AVQPROD_0000000000000022.txt", data_host="xh515", data_sourcetype="P_AVQ_Aktive_Automic_Jobs_AVQPROD-too_small"

props.conf
[source::/opt/uc4/srvavq/*/share/ae/temp/toSplunk/ARIZON_CS/*/*/*.txt]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Timestamp


Data File like this:
{"Timestamp" : 1626874253, "Anzahl" : "7", "userstamp" : "RM", "status" : "Processed", "taskname" : "task_secevt2_apply_sinstr.rm","env":"AVQPROD"}
{"Timestamp" : 1626874221, "Anzahl" : "1", "userstamp" : "IMED_65454_54222", "status" : "Processed", "taskname" : "rm.set_resp","env":"AVQPROD"}

Re: UFW parsing JSON ERROR

venkatasri — Thu, 22 Jul 2021 00:08:03 GMT

Hi @bardill

There is a lot of discussion on this one hope this helps - Forwarder tells me there's an "ERROR JsonLineBreak... - Splunk Community

An upvote would be appreciated if this reply helps!

Re: UFW parsing JSON ERROR

bardill — Thu, 22 Jul 2021 09:53:37 GMT

Sorry that not help
We not read the splunkd.log as json!!

We read a log file over an APP

topic Re: UFW parsing JSON ERROR in Getting Data In

UFW parsing JSON ERROR

Re: UFW parsing JSON ERROR

Re: UFW parsing JSON ERROR