Getting Data In
Highlighted

Why am I getting this JSON Parsing error?: "parsing error:Unexpected character while looking for value"

Hi community,

I have a strange issue when i try to parse a JSON :

i have a basic JSON like this with 100 line:

{"id": "0APIClUQ6m77NUk9PVA", "name": "Applications"}
{"id": "0ALB842-DsLmBUk9PVA", "name": "Automatisation Support"}

When i try to index with my props :

[ _json ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true

i got this error message many times :

09-07-2018 08:46:09.039 +0200 ERROR JsonLineBreaker - JSON StreamId:18348078207081945231 had parsing error:Unexpected character while expecting '"': '\\' - data_source="C:\Scripts\Gsuite_Report\teamdrive_settings\2018-09-07_teamdrive_report.json", data_host="DSCRIPT02", data_sourcetype="_json"
09-07-2018 08:46:09.039 +0200 ERROR JsonLineBreaker - JSON StreamId:18348078207081945231 had parsing error:Unexpected character while looking for value: '\\' - data_source="C:\Scripts\Gsuite_Report\teamdrive_settings\2018-09-07_teamdrive_report.json", data_host="DSCRIPT02", data_sourcetype="_json"

can you help me ?

Tags (2)
0 Karma
Highlighted

Re: Why am I getting this JSON Parsing error?: "parsing error:Unexpected character while looking for value"

SplunkTrust
SplunkTrust

Hi @ serviceinfrastructure,

Can you please try with below props.conf configuration on your Universal Forwarder ?

[yoursourcetype]
INDEXED_EXTRACTIONS = json
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.