Getting Data In

Your entry was not saved. The following error was reported: SyntaxError: Unexpected token < in JSON at position 0.


Reproduce the error:
1. Export the results of a previous search job (a table with 22 fields and 32k+ rows) as a CSV.
2. Attempt to upload CSV as a new lookup file with CSV filetype selected.

Why do I get this error? I've seen error messages similar to this for other peoples' questions but I have not seen any where the issue comes from trying to upload a CSV as a lookup file.

0 Karma


I have seen this error when my authentication to Splunk has expired.

When I reauthenticate, the error has gone away.

0 Karma


It sounds like it's trying to ingest the file as a json rather than as a csv. Perhaps somebody touched the file with Excel and Microsoft converted it?

First, verify that the file is, in fact, a plain csv down on the box, by attempting to edit it with a vanilla editor (notepad++ or something like that).

Second, step through the upload one item at a time and read every instruction or message. This sounds vaguely familiar, and I'm pretty sure it's just either the file has been altered or an option that went wonky.

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...