About kulrajatwal

kulrajatwal · ‎11-15-2021

I found by running json through cat <json file> | od -A n -t x1 I could see all the hex chars relating to the splunk errors and fix the json to a format splunk accepts

kulrajatwal · ‎11-15-2021

I ended up using the authhandlers.py script in $SPLUNK_HOME/etc/apps/rest_ta/bin Used python to get a new token every hour, referenced that function in the ui for rest.

kulrajatwal · ‎11-11-2021

I am forwarding some json files from a splunk forwarder on linux, example file below: { "dateTime" : "04/11/2021 08:22:30", "functionName" : "ZAUTOPSRALL", "userId" : "sanchez", "issueCategory" : "PSR", "issueType" : "HDRUNKNOWN", "issueSummary" : "PSR File Processing â\u0080\u0093 Cannot match to original file", "issueDescription" : "The received PSR file "PSR_CBD174.PAIN001_DTLRJCT3.xml" refers to an unknown original file.\n\nPSR file\nName: PSR_CBD174.PAIN001_DTLRJCT3.xml\nCreated: 2021-10-08T12:09:43+01:00\nMessage ID: LBG/0000000027834/003\n\nReference to original file\nMessage ID: MSGID/PAIN001/20210913T100930/1\nStatus: RJCT\nControl sum: 38965.82\nNumber of transactions: 86", "exceptionType" : null, "notificationId" : null, "timeStamp" : 1636014150661056 } Its not being indexed, i found the following errors for this fle in the splunkd.log I ran the json through a json checker and it was valid so not sure why splunk is complaining. Any help would be much apreciated. 11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json" 11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json" 11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json" 11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character: ':' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json" 11-05-2021 15:48:57.625 +0000 ERROR JsonLineBreaker [10224113 structuredparsing] - JSON StreamId:14224088848725967690 had parsing error:Unexpected character in string: '\0A' - data_source="/sanchez/instances/beta/log/splunk/splunk_1636014150661056_19399032.json", data_host="pbasalsldw002", data_sourcetype="_json"

kulrajatwal · ‎08-03-2020

Hi I am having a simular issue. My token expires after 1 hour but it was failing after the first attempt. I found in $SPLUNK_HOME/etc/apps/rest_ta/bin/rest.py token["expires_in"] = "5" So it expires in 5 seconds, i set this to 3600 so it uses the same token for an hour and that works, only problem now is its not refreshing the token as timing out going to the refresh token URL. The proxy and routig to the url is fine so I think its something in the python code in the rest addon. Any help appreciated.

Posts	5
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎07-17-2018

Online Status	Offline
Date Last Visited	‎11-15-2021 10:52 AM

jsonlinebreaker processing a valid json file

Re: jsonlinebreaker processing a valid json file

Re: Why does only first request works with REST AP...

jsonlinebreaker processing a valid json file

Re: REST API OAuth2 only first request works.