topic Re: Json logs not parsing properly. in Dashboards & Visualizations

Json logs not parsing properly.

mahesh27 — Thu, 22 Aug 2024 00:00:04 GMT

Hi All, We have a json logs where few logs are not parsing properly. When i check internal logs its shows that truncate value exceed the default 10000 bytes, so i tried increasing truncate value to 40000, but still logs are not parsing correctly.

the logs length is around 26000.

props used:

[app:json:logs] SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) CHARSET=UTF-8 TIMEPREFIX=\{\"timestamp"\:\" KV_MODE=json TRUNCATE=40000

Re: Json logs not parsing properly.

gcusello — Wed, 21 Aug 2024 14:35:26 GMT

Hi @mahesh27 ,

try to add INDEXED_EXTRACTIONS = JSON to your props.conf

Ciao.

Giuseppe

Re: Json logs not parsing properly.

mahesh27 — Wed, 21 Aug 2024 14:39:45 GMT

Hi @gcusello, sorry we have a limitation not to use that is there any other way

Re: Json logs not parsing properly.

gcusello — Wed, 21 Aug 2024 14:42:22 GMT

Hi @mahesh27 ,

try the spath command (https://docs.splunk.com/Documentation/Splunk/9.3.0/SearchReference/Spath )

Ciao.

Giuseppe

Re: Json logs not parsing properly.

nmohammed — Wed, 21 Aug 2024 20:46:27 GMT

Try adding a limits.conf with the following

[kv] maxchars = 40000