Hello,
I'm struggling with finding a parser in splunk for the following log:
May 20 12:22:21 127.0.0.1 {"rootId": "AXIxikL8ao-yaSvA", "requestId": "f6a873jkjjkjk:-8000:5738", "details": {"flag...
See more...
Hello,
I'm struggling with finding a parser in splunk for the following log:
May 20 12:22:21 127.0.0.1 {"rootId": "AXIxikL8ao-yaSvA", "requestId": "f6a873jkjjkjk:-8000:5738", "details": {"flag": false, "title": "task 1", "status": "Waiting", "group": "", "order": 0}, "operation": "Creation", "objectId": "AXIyCN5Oao-H5aYyaSvd", "startDate": 1589977341890, "objectType": "case_task", "base": true, "object": {"_routing": "AXIxikL8ao-H5aYyaSvA", "flag": false, "_type": "case_task", "title": "task 1", "createdAt": 1589977341516, "_parent": "AXIxikL8ao-H5aYyaSvA", "createdBy": "user", "_id": "AXIyCN5Oao-H5aYyaSvd", "id": "AXIyCN5Oao-H5aYyaSvd", "_version": 1, "order": 0, "status": "Waiting", "group": ""}}
The log itself is a valid json, and i can parse it well with the default _json parser. However, splunk inserts the datetime and hostname at the beginning of the log, which makes the parser stop working..
Is there any workaround for this?
Thanks!