×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
anayar
Engager
Member since: ‎10-10-2018
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎10-10-2018
Activity Feed
View All

Re: ERROR JsonLineBreaker

by in Getting Data In
‎04-23-2019 02:08 PM
‎04-23-2019 02:08 PM
Yup, I removed splunkd.log from smn-sn-util01 and the issue persisted. Here's the output of the command: /opt/splunkforwarder/etc/apps/search/default/props.conf [splunkd] /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/apps/search/default/props.conf EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+\-]\d+ )?(?P<log_level>[^ ]*)\s+(?P<component>[^ ]+) - (?P<message>.+) /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TIME_FORMAT = %s /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TIME_FORMAT = %s /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TIME_FORMAT = %s /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TIME_FORMAT = %s /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC /opt/splunkforwarder/etc/system/local/props.conf AUTO_KV_JSON = false /opt/splunkforwarder/etc/system/local/props.conf INDEXED_EXTRACTIONS = JSON /opt/splunkforwarder/etc/system/local/props.conf KV_MODE = none /opt/splunkforwarder/etc/system/local/props.conf TIMESTAMP_FIELDS = _time /opt/splunkforwarder/etc/system/local/props.conf TIME_FORMAT = %s /opt/splunkforwarder/etc/system/local/props.conf TZ = UTC ... View more

ERROR JsonLineBreaker

by in Getting Data In
‎04-23-2019 11:02 AM
‎04-23-2019 11:02 AM
Hi all, I don’t know exactly how long this has been going on but I noticed today that the following error is being spammed into the /opt/splunkforwarder/var/log/splunk/splunkd.log file on our system. 04-22-2019 17:36:10.474 -0700 ERROR JsonLineBreaker - JSON StreamId:14919777892573414995 had parsing error:Unexpected character: '4' - data_source="/opt/splunkforwarder/var/log/splunk/splunkd.log", data_host="smn-sn-util01", data_sourcetype="splunkd" 04-22-2019 17:36:10.474 -0700 ERROR JsonLineBreaker - JSON StreamId:14919777892573414995 had parsing error:Unexpected character: '4' - data_source="/opt/splunkforwarder/var/log/splunk/splunkd.log", data_host="smn-sn-util01", data_sourcetype="splunkd" There's also this error which occasionally pops up in the log but not nearly as frequently as the one above: 04-22-2019 17:47:05.009 -0700 ERROR JsonLineBreaker - JSON StreamId:8970828008188520838 had parsing error:Unexpected character while looking for value: 'A' - data_source="/var/log/messages", data_host="smn-sn-util01", data_sourcetype="syslog" 04-22-2019 17:47:05.009 -0700 ERROR JsonLineBreaker - JSON StreamId:8970828008188520838 had parsing error:Unexpected character while looking for value: 'A' - data_source="/var/log/messages", data_host="smn-sn-util01", data_sourcetype="syslog" I tried stopping splunk, removing all the splunkd.log* files, and then restarting splunk but the error continues to show up in the logs. Any ideas as to what may be causing this? ... View more

Re: Pie chart eval in drilldown search

by in Dashboards & Visualizations
‎10-11-2018 09:19 AM
‎10-11-2018 09:19 AM
Nice, this worked. I had to change the "%24click.value%24%" to a literal "$click.value$" in my XML but other than that change it worked. Thanks! ... View more

Pie chart eval in drilldown search

by in Dashboards & Visualizations
‎10-10-2018 04:13 PM
‎10-10-2018 04:13 PM
I have a pie chart that divides things up by severity. The query for that is: index=os sourcetype=events host=util04 | lookup pre_organizations.csv organization |dedup _time,event_id,counter| search event_type="cleared"| stats count by severity When the user clicks on one of the pie slices, I'd like it to display a table of the following search: <drilldown> <link target="_blank">search?q=index=os sourcetype=events host=util04 | lookup pre_organizations.csv organization |dedup _time,event_id,counter | search event_type="cleared" severity=$click.value$| eval eventTime=strftime(_time, "%Y-%m-%d %H:%M:%S")|table event_id,eventTime,severity,message </link> </drilldown> The "eval eventTime" portion is breaking my search and I don't know how to get around this. Any ideas? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All