Hi, @sainag_splunk My problem is still remained. Sorry for that your solution didn't solve my problem... I tried some cases more, will ask about I tried cases. By the way, I have another questio...
See more...
Hi, @sainag_splunk My problem is still remained. Sorry for that your solution didn't solve my problem... I tried some cases more, will ask about I tried cases. By the way, I have another question for this issue. I tried to change the props.conf for json parsing, "KV_MODE=json" -> "KV_MODE=none" Add "INDEXED_EXTRACTIONS=json" But I think there are errors in parsing to json. Why this errors was occurred?? My search query is index=_internal JsonLineBreaker NOT StreamedSearch And results show many below lines. 10-10-2024 13:05:55.318 +0900 ERROR JsonLineBreaker [2427 structuredparsing] - JSON StreamId:8181676460594335103 had parsing error:Unexpected character while looking for value: '}' - data_source="*****.json", data_host="****", data_sourcetype="my_json" host = **** source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd 10-10-2024 13:05:55.315 +0900 ERROR JsonLineBreaker [2427 structuredparsing] - JSON StreamId:8181676460594335103 had parsing error:Unexpected character while looking for value: '}' - data_source="*****.json", data_host="****", data_sourcetype="my_json" host = **** source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd ... I checked the json file, but there is no invalid characters in json. Also, I tried to parse json in Python or JsonParseWebEditor,,, there is no problems. Why this logs are remained??