Hi, @sainag_splunk I entered your search command on my splunk search app, the results were not shown. No results in your command from my source type, "my_json". I have confused how to resolve this...
See more...
Hi, @sainag_splunk I entered your search command on my splunk search app, the results were not shown. No results in your command from my source type, "my_json". I have confused how to resolve this issue, It may cause critical errors for analysing our data. Is there anything to try to resolve the issue? I have tried that, the data has line breaking after ':', so the parsing error was caused, in my think. I treid to change the value "LINE_BREAKER=[}|,]+[\r\n]+", this means if the end of line is ":\r\n", UF will don't break the line. But though changing the LINE_BREAKER value, the parsing errors are still raised. 24/10/23 12:02:22.193 10-23-2024 12:02:22.193 +0900 ERROR JsonLineBreaker [7804 structuredparsing] - JSON StreamId:15916142412051242565 had parsing error:Unexpected character: ':' - data_source="C:\splunk\<my_path>.bin", data_host="<my_host>", data_sourcetype="my_json"