Getting Data In

How to resolve "Unexpected token < in JSON at position 0" error while creating the summary index?

index=***** source="****" "getProcedureDetailBlueChip" OR "getProcedureDetailBlueChipResponse" 
AND "Outbound Message" OR "Inbound Message" OR "getProcedureDetailBlueChip response time returning procedure details" OR "memZipCode assigned to zipCode" 
OR "provZipCode assigned to zipCode" OR  "bnftAgrmtNbr"|rex "(?Inbound|Outbound)" |eval transfield=if(searchmatch("Outbound Message") OR searchmatch("Inbound Message"),1,0) | accum transfield | transaction transfield | rex "ID:(?.*)" 
|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?m)\(?.*)"|rex "(?.*)" |rex "(?.*)"|rex "(?.*)" | rex "(?.*)" | rex "(?.*)" |rex "(?.*)" |rex "(?.*)"|rex "(?.*)"| rex "(?.*)"|rex "(?.*)" |rex "provZipCode assigned to zipCode:(?.*)"| rex "memZipCode assigned to zipCode:(?.*)"|stats min(_time) as startTime,max(_time) as endTime,values(info) as Info,values(ResponseTime) as responseTime,values(StatusCode) as StatusCode,values(message) as StatusMessage,values(CorpEntCd) as corpEntCd,values(costlvlpctl) as Costlvlpctl,values(CptCode) as cptCode,values(GroupNbr) as GroupNbr,values(MemZipCode) as memZipCode,values(procdchrgamt) as ProcChrgamt,values(ProvZipCode) as ProvZipCode,values(SectionNbr) as SectionNbr,values(ServiceDate) as ServiceDate,values(tretcatcd) as TretCatCd,values(tretcatname) as TretCatName,values(bnftAgrmtNbr) as bnftAgrmtNbr,values(acctNbr) as acctNbr,values(provassignZip) as provassignZip,values(memzipassignzip) as memzipassignzip by id,source
|eval responseTime=endTime-startTime|eval StartTime=strftime(startTime,"%Y-%m-%d %H:%M:%S,%3N")|eval EndTime=strftime(endTime,"%Y-%m-%d %H:%M:%S,%3N")
|table id,Info,StartTime,EndTime,responseTime,StatusCode,StatusMessage,source,corpEntCd,Costlvlpctl,cptCode,GroupNbr,memZipCode,ProcChrgamt,ProvZipCode,SectionNbr,ServiceDate,TretCatCd,TretCatName,bnftAgrmtNbr,acctNbr,provassignZip,memzipassignzip

while creating the summary index it's throwing an error "Unexpected token < in JSON at position 0." how can i resolve this? can someone help me please?


really? The answer is Chrome isn't supported in Splunk 7.0?

Loves-to-Learn Lots

actually it seems so that chrome is the only one giving problems

0 Karma


Seems to be a browser compatibility issue. I was able to avoid this error by doing the following:

Workaround: Use Firefox as your browser,I experianced the same issue. After reading other above mentioned posts, I guessed it might be a browser compatibility issue with the posting, so I opened Firefox (was using Chrome) and everything began working as expected.

Work-around: Use Firefox instead of Chrome


you saved me so much time, I would have never thought the browser to be the issue, it seemed like such a splunk-side problem..

0 Karma


@worm929 @codeassassin, do look at the the first answer posted by @somesoni2 where Google Chrome Browser Extension may cause this error. So try to stop any browser extensions that might be running and test.

We noticed issue with saving Knowledge Object configurations where error for Unexpected Token would pop up however, the configuration would get saved. On stopping Chrome Extension, the error was fixed.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


thanks somesh that case i need to change my code where the rex commads are their.

0 Karma


some of the regex were truncated....
|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?m)(?.)"|rex "(?.)" |rex "(?.)"|rex "(?.)" | rex "(?.)" | rex "(?.)" |rex "(?.)" |rex "(?.)"|rex "(?.)"| rex "(?.)"|rex "(?.)" |rex "provZipCode assigned to zipCode:(?.)"| rex "memZipCode assigned to zipCode:(?.*)"

0 Karma

Splunk Employee
Splunk Employee

Just so you know, there is special markup language on this site so certain symbols will transform your post. If you wrap a word in the asterisk symbol * or _, without wrapping it in a code sample, it will italicize the word. If you wish to show the * (i.e. you are displaying sample code), simply click on the Code Sample icon to the right of the Blockquote icon in the formatting toolbar. That is how I was able to edit your post so that the * will display.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...