Getting Data In

How to resolve "Unexpected token < in JSON at position 0" error while creating the summary index?

prashanthberam
Explorer
index=***** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" 
AND "Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" 
OR "provZipCode assigned to zipCode" OR  "bnftAgrmtNbr"|rex "(?Inbound|Outbound)" |eval transfield=if(searchmatch("Outbound Message") OR searchmatch("Inbound Message"),1,0) | accum transfield | transaction transfield | rex "ID:(?.*)" 
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?.*)" |rex "(?.*)"|rex "(?.*)" | rex "(?.*)" | rex "(?.*)" |rex "(?.*)" |rex "(?.*)"|rex "(?.*)"| rex "(?.*)"|rex "(?.*)" |rex "provZipCode assigned to zipCode:(?.*)"| rex "memZipCode assigned to zipCode:(?.*)"|stats min(_time) as startTime,max(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage,values(CorpEntCd) as corpEntCd,values(costlvlpctl) as Costlvlpctl,values(CptCode) as cptCode,values(GroupNbr) as GroupNbr,values(MemZipCode) as memZipCode,values(procdchrgamt) as ProcChrgamt,values(ProvZipCode) as ProvZipCode,values(SectionNbr) as SectionNbr,values(ServiceDate) as ServiceDate,values(tretcatcd) as TretCatCd,values(tretcatname) as TretCatName,values(bnftAgrmtNbr) as bnftAgrmtNbr,values(acctNbr) as acctNbr,values(provassignZip) as provassignZip,values(memzipassignzip) as memzipassignzip by id,source
|eval responseTime=endTime-startTime|eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")
|table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source,corpEntCd,Costlvlpctl,cptCode,GroupNbr,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,provassignZip,memzipassignzip

while creating the summary index it's throwing an error "Unexpected token < in JSON at position 0." how can i resolve this? can someone help me please?
thanks

irievibe
Explorer

really? The answer is Chrome isn't supported in Splunk 7.0?

KSinghK
Loves-to-Learn Lots

actually it seems so that chrome is the only one giving problems

0 Karma

codeassassin
Engager

Seems to be a browser compatibility issue. I was able to avoid this error by doing the following:

Workaround: Use Firefox as your browser,I experianced the same issue. After reading other above mentioned posts, I guessed it might be a browser compatibility issue with the posting, so I opened Firefox (was using Chrome) and everything began working as expected.

Work-around: Use Firefox instead of Chrome

worm929
Explorer

THANK YOU.
you saved me so much time, I would have never thought the browser to be the issue, it seemed like such a splunk-side problem..

0 Karma

niketn
Legend

@worm929 @codeassassin, do look at the the first answer posted by @somesoni2 where Google Chrome Browser Extension may cause this error. So try to stop any browser extensions that might be running and test.

https://answers.splunk.com/answers/247389/cant-add-input-for-rest-ta-your-entry-was-not-save-1.html

We noticed issue with saving Knowledge Object configurations where error for Unexpected Token would pop up however, the configuration would get saved. On stopping Chrome Extension, the error was fixed.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

prashanthberam
Explorer

thanks somesh ..in that case i need to change my code where the rex commads are their.

0 Karma

prashanthberam
Explorer

some of the regex were truncated....
|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?.)" |rex "(?.)"|rex "(?.)" | rex "(?.)" | rex "(?.)" |rex "(?.)" |rex "(?.)"|rex "(?.)"| rex "(?.)"|rex "(?.)" |rex "provZipCode assigned to zipCode:(?.)"| rex "memZipCode assigned to zipCode:(?.*)"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...