All Apps and Add-ons

Stream App for Stream: field parsing problem when binary src_content or dest_content fields are there

kwchang_splunk
Splunk Employee
Splunk Employee

Dear Stream Experts,

I have a field parsing problem when there are binary(?) src_content or dest_content as following image.
There is src_content and dest_content in _raw, but those fields are not parsed correctly by default.
All fields which appear after the binary src_content or dest_content seem to have problems.

And the web UI is also broken. I selected "List" view but displayed like "Raw" view.

I'm using Splunk App for Stream 6.4.1 on Splunk 6.3.1.
Thank you in advance.

alt text

Tags (1)
0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

hi kwchang,

Seems like Splunk fails to parse this event, despite the event containing properly formatted JSON. I'd recommend opening a ticket in JIRA (SPL project)

View solution in original post

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

hi kwchang,

Seems like Splunk fails to parse this event, despite the event containing properly formatted JSON. I'd recommend opening a ticket in JIRA (SPL project)

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...