Found this question while researching a "ERROR JsonLineBreaker" "Unexpected character" events in my Splunk. I tried to re-create the error using Splunk 7.1.2 but the provided curl command fails due invalid JSON. curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk ${TOKEN}" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins",["regionals","nationals"]}}' {"text":"Invalid dataformat","code":6,"invalid-event-number":0} "wins" is followed by a "," when it should be a ":". Correcting the issue yields a "Success" message w/ no "ERROR JsonLineBreaker" logged. curl -k https://localhost:8088/services/collector/event -H "Authorization: Splunk ${TOKEN}" -d '{"event": "Hello, McKinley High!", "sourcetype": "_json", "fields": {"club":"glee", "wins": ["regionals","nationals"]}}'; echo {"text":"Success","code":0} FWIW, the JSON typo came from Splunk's "Explicit JSON fields" example at: http://dev.splunk.com/view/event-collector/SP-CAAAFB6 ... View more

I'm unable to check the UI since we disable the UI and manage HEC configuration directly via the .conf files. Here's a stripped down version of our inputs.conf and outputs.conf. This configuration sends to both sets of indexers and overrides defaultGroup, which is set to a third set of indexers. # inputs.conf [http://foo] outputgroup = abc_indexers,xyz_indexers # outputs.conf [tcpout] defaultGroup = default_indexers [tcpout:abc_indexers] server = abc [tcpout: xyz_indexers] server = xyz ... View more

Yup, for the HEC forwarders I manage, I'm able to have a token send to multiple groups using a configuration similar to the one I posted on June 27, 2017. ... View more

Splunk 7.1.0 now supports High Sierra (10.13): http://docs.splunk.com/Documentation/Splunk/7.1.0/Installation/Systemrequirements#Unix_operating_systems ... View more

yannK: I had this issue using Splunk 7.0.0 on High Sierra using APFS and have filed a support case requesting APFS support. ... View more

The 'OPTIMISTIC_ABOUT_FILE_LOCKING = 1' appears to only be needed for OSX High Sierra running off a APFS volume. My High Sierra system running off a Mac OS Extended volume did not need this setting. ... View more

I've used 'outputgroup' to send data to specific output groups. In the following example, token-A sends data to abc_indexers, token-B sends data to xyz_indexers, and token-C clones data to both abc_indexers and xyz_indexers. [http://token-A] outputgroup = abc_indexers [http://token-B] outputgroup = xyz_indexers [http://token-C] outputgroup = abc_indexers,xyz_indexers ... View more

Per the error message, try using POST instead of GET. For example: curl -X POST -k -u admin "https://localhost:8089/services/server/control/restart" ... View more

Thanks. Unfortunately, the person who configured the segmenter file on instance 2 no longer works at our company. I'll try to figure out the intent of the changes. ... View more

The [search], [standard], and [inner] stanzas in segmenters.conf differ between the two instances. Should I update the stanzas on instance 2 to match instance 1? ... View more