Splunk Search

Issues while parsing lengthy Json

dasnitu5
New Member

We are facing issue while parsing the lengthy Json file. Splunk is picking up incomplete data. Attaching the specifications of source type used, any help would be appreciated. Thanks!!

dasnitu5_0-1611122604897.jpeg

 

 

Labels (1)
0 Karma

to4kawa
Ultra Champion

What happened with that setting? Without specifics, it's hard to tell.

0 Karma

dasnitu5
New Member

 

Hi @to4kawa ,

The given source type(provided in the screenshot) was parsing the long JSON input correctly till few days back. But after migrating from Splunk version 7.3.4 to 8.0.5, the full JSON data is not getting picked up by Splunk.

Is there some attribute present in configuration files of Splunk which defines the length of an event ? If yes, we can try increasing its value so that we get complete data and it gets correctly parsed by the given sourcetype?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...