UFW parsing JSON ERROR

[bardill]

After we upgraded from 7.3 to 8.1.4, the UF can no longer read the json data.
07-21-2021 16:03:02.643 +0200 ERROR JsonLineBreaker - JSON StreamId:427620843244980635 had parsing error:Unexpected character while expecting ':': 'S' - data_source="/opt/uc4/srvavq/prod/share/ae/temp/toSplunk/OPT_REP/normal/ARIZON_CS_UC4_ActiveSchedJobs/P_AVQ_Aktive_Automic_Jobs_AVQPROD_0000000000000022.txt", data_host="xh515", data_sourcetype="P_AVQ_Aktive_Automic_Jobs_AVQPROD-too_small"

props.conf
[source::/opt/uc4/srvavq/*/share/ae/temp/toSplunk/ARIZON_CS/*/*/*.txt]
INDEXED_EXTRACTIONS = json
TIMESTAMP_FIELDS = Timestamp


Data File like this:
{"Timestamp" : 1626874253, "Anzahl" : "7", "userstamp" : "RM", "status" : "Processed", "taskname" : "task_secevt2_apply_sinstr.rm","env":"AVQPROD"}
{"Timestamp" : 1626874221, "Anzahl" : "1", "userstamp" : "IMED_65454_54222", "status" : "Processed", "taskname" : "rm.set_resp","env":"AVQPROD"}

[venkatasri]

Hi @bardill 

There is a lot of discussion on this one hope this helps - Forwarder tells me there's an "ERROR JsonLineBreak... - Splunk Community

--

An upvote would be appreciated if this reply helps!

[bardill · Accepted solution]

Sorry that not help
We not read the splunkd.log as json!!

We read a log file over an APP