Getting Data In

jsonlinebreaker processing a valid json file

kulrajatwal
Explorer

I am forwarding some json files from a splunk forwarder on linux, example file below:

{
"dateTime" : "04/11/2021 08:22:30",
"functionName" : "ZAUTOPSRALL",
"userId" : "sanchez",
"issueCategory" : "PSR",
"issueType" : "HDRUNKNOWN",
"issueSummary" : "PSR File Processing â\u0080\u0093 Cannot match to original file",
"issueDescription" : "The received PSR file "PSR_CBD174.PAIN001_DTLRJCT3.xml" refers to an unknown original file.\n\nPSR file\nName: PSR_CBD174.PAIN001_DTLRJCT3.xml\nCreated: 2021-10-08T12:09:43+01:00\nMessage ID: LBG/0000000027834/003\n\nReference to original file\nMessage ID: MSGID/PAIN001/20210913T100930/1\nStatus: RJCT\nControl sum: 38965.82\nNumber of transactions: 86",
"exceptionType" : null,
"notificationId" : null,
"timeStamp" : 1636014150661056
}

Its not being indexed, i found the following errors for this fle in the splunkd.log

 

I ran the json through a json checker and it was valid so not sure why splunk is complaining.  Any help would be much apreciated.


11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character in string: '\0A' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

Labels (2)
0 Karma
1 Solution

kulrajatwal
Explorer

I found by running json through

cat <json file> | od -A n -t x1

 

I could see all the hex chars relating to the splunk errors and fix the json to a format splunk accepts

View solution in original post

kulrajatwal
Explorer

I found by running json through

cat <json file> | od -A n -t x1

 

I could see all the hex chars relating to the splunk errors and fix the json to a format splunk accepts

WonjinKim
Engager

Hi @kulrajatwal 

How to check in hex chars?

I have the same issues in my splunk, So I got the raw data file and process your command to it.

But I don't know how to check the invalid chars in my raw data.

Could you explain in detail? What is the splunk's accepted format? and how to fix in my json?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...