Json logs not parsing properly.

[mahesh27]

Hi All, We have a json logs where few logs are not parsing properly. When i check internal logs its shows that truncate value exceed the default 10000 bytes, so i tried increasing truncate value to 40000, but still logs are not parsing correctly.

the logs length is around  26000.

props used:

[app:json:logs]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
CHARSET=UTF-8
TIMEPREFIX=\{\"timestamp"\:\"
KV_MODE=json
TRUNCATE=40000

[nmohammed]

Try adding a limits.conf with the following

[kv]
maxchars = 40000

[gcusello]

Hi @mahesh27 ,

try to add INDEXED_EXTRACTIONS = JSON to your props.conf

Ciao.

Giuseppe

[mahesh27]

Hi @gcusello, sorry we have a limitation not to use that is there any other way 

[gcusello]

Hi @mahesh27 ,

try the spath command (https://docs.splunk.com/Documentation/Splunk/9.3.0/SearchReference/Spath )

Ciao.

Giuseppe