Splunk Cloud Platform

Ingesting Event format JSON

CarolinaHB
Explorer

Hello, good mornig. 

Currently, I am sending the following data, but when ingested into Splunk, it is not recognized in JSON format.

 

 

 

Feb  5 18:50:30 10.0.30.81 {"LogTimestamp": "Tue Feb  6 00:50:31 2024","Customer": "xxxxxx","SessionID": "xxxxxx","SessionType": "TTN_ASSISTANT_BROKER_STATS","SessionStatus": "TT_STATUS_AUTHENTICATED","Version": "","Platform": "","XXX": "XX-X-9888","Connector": "XXXXXXXX","ConnectorGroup": "XXX XXX XXXXXX GROUP","PrivateIP": "","PublicIP": "18.24.9.8","Latitude": 0.000000,"Longitude": 0.000000,"CountryCode": "","TimestampAuthentication": "2024-01-28T09:26:31.592Z","TimestampUnAuthentication": "","CPUUtilization": 0,"MemUtilization": 0,"ServiceCount": 0,"InterfaceDefRoute": "","DefRouteGW": "","PrimaryDNSResolver": "","HostStartTime": "0","ConnectorStartTime": "0","NumOfInterfaces": 0,"BytesRxInterface": 0,"PacketsRxInterface": 0,"ErrorsRxInterface": 0,"DiscardsRxInterface": 0,"BytesTxInterface": 0,"PacketsTxInterface": 0,"ErrorsTxInterface": 0,"DiscardsTxInterface": 0,"TotalBytesRx": 19162399,"TotalBytesTx": 16432931,"MicroTenantID": "0"}

 

Can you help me? 

Can this line be removed using the forwarder from the props files?

Regards, 

Labels (1)
Tags (3)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @CarolinaHB,

JSON format should be only valid JSON string.

If you can send log by removing  first "Feb 5 18:50:30 10.0.30.81"  then it should be shown as a JSON.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not recognized as JSON format because it isn't JSON format.  The text before the first { disqualifies it.

How are you ingesting this event?  What are the inputs.conf and props.conf settings?

---
If this reply helps you, Karma would be appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @CarolinaHB,

JSON format should be only valid JSON string.

If you can send log by removing  first "Feb 5 18:50:30 10.0.30.81"  then it should be shown as a JSON.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

CarolinaHB
Explorer

Can this line be removed using the forwarder from the props.conf files?"

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...