Getting Data In

How to resolve "Unexpected token < in JSON at position 0" error while creating the summary index?

index=***** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" 
AND "Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" 
OR "provZipCode assigned to zipCode" OR  "bnftAgrmtNbr"|rex "(?Inbound|Outbound)" |eval transfield=if(searchmatch("Outbound Message") OR searchmatch("Inbound Message"),1,0) | accum transfield | transaction transfield | rex "ID:(?.*)" 
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?.*)" |rex "(?.*)"|rex "(?.*)" | rex "(?.*)" | rex "(?.*)" |rex "(?.*)" |rex "(?.*)"|rex "(?.*)"| rex "(?.*)"|rex "(?.*)" |rex "provZipCode assigned to zipCode:(?.*)"| rex "memZipCode assigned to zipCode:(?.*)"|stats min(_time) as startTime,max(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage,values(CorpEntCd) as corpEntCd,values(costlvlpctl) as Costlvlpctl,values(CptCode) as cptCode,values(GroupNbr) as GroupNbr,values(MemZipCode) as memZipCode,values(procdchrgamt) as ProcChrgamt,values(ProvZipCode) as ProvZipCode,values(SectionNbr) as SectionNbr,values(ServiceDate) as ServiceDate,values(tretcatcd) as TretCatCd,values(tretcatname) as TretCatName,values(bnftAgrmtNbr) as bnftAgrmtNbr,values(acctNbr) as acctNbr,values(provassignZip) as provassignZip,values(memzipassignzip) as memzipassignzip by id,source
|eval responseTime=endTime-startTime|eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")
|table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source,corpEntCd,Costlvlpctl,cptCode,GroupNbr,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,provassignZip,memzipassignzip

while creating the summary index it's throwing an error "Unexpected token < in JSON at position 0." how can i resolve this? can someone help me please?


really? The answer is Chrome isn't supported in Splunk 7.0?

Loves-to-Learn Lots

actually it seems so that chrome is the only one giving problems

0 Karma


Seems to be a browser compatibility issue. I was able to avoid this error by doing the following:

Workaround: Use Firefox as your browser,I experianced the same issue. After reading other above mentioned posts, I guessed it might be a browser compatibility issue with the posting, so I opened Firefox (was using Chrome) and everything began working as expected.

Work-around: Use Firefox instead of Chrome


you saved me so much time, I would have never thought the browser to be the issue, it seemed like such a splunk-side problem..

0 Karma

@worm929 @codeassassin, do look at the the first answer posted by @somesoni2 where Google Chrome Browser Extension may cause this error. So try to stop any browser extensions that might be running and test.

We noticed issue with saving Knowledge Object configurations where error for Unexpected Token would pop up however, the configuration would get saved. On stopping Chrome Extension, the error was fixed.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Revered Legend
0 Karma


thanks somesh that case i need to change my code where the rex commads are their.

0 Karma


some of the regex were truncated....
|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?.)" |rex "(?.)"|rex "(?.)" | rex "(?.)" | rex "(?.)" |rex "(?.)" |rex "(?.)"|rex "(?.)"| rex "(?.)"|rex "(?.)" |rex "provZipCode assigned to zipCode:(?.)"| rex "memZipCode assigned to zipCode:(?.*)"

0 Karma

Splunk Employee
Splunk Employee

Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...