×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
svaj925
Observer
Member since: ‎01-05-2021
‎01-09-2021
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎01-05-2021
View All

Re: Splunk Connect for Kubernetes is parsing json ...

by in All Apps and Add-ons
‎01-08-2021 07:54 AM
‎01-08-2021 07:54 AM
I tried adding multiline as below (since our json output starts with "{")     multiline: firstline: /^{/ flushInterval: 1     Now we can see json output parsing correctly as single event in some occurrences and in some cases, there are additional lines included in the same event (see below example). Is there an option to include something like last/end line parameter to multiline options? or any other way to fix this.  Appreciate your help/suggestion regarding this issue. ... View more

Re: Splunk Connect for Kubernetes is parsing json ...

by in All Apps and Add-ons
‎01-07-2021 05:16 PM
‎01-07-2021 05:16 PM
In container logs on worker node, json is line by line and also  "/n" is included for each line   {"log":"{\n","stream":"stdout","time":"2021-01-07T23:37:54.053738972Z"} {"log":" \"payload\" : \"\",\n","stream":"stdout","time":"2021-01-07T23:37:54.053746532Z"} {"log":" \"sessionInfo\" : {\n","stream":"stdout","time":"2021-01-07T23:37:54.053751058Z"} {"log":" \"userId\" : \"\",\n","stream":"stdout","time":"2021-01-07T23:37:54.053755004Z"} {"log":" \"sessionId\" : \"WT-3bF-VK35ZlXvqvUzT3kdkRsc\",\n","stream":"stdout","time":"2021-01-07T23:37:54.053759095Z"} {"log":" \"ipAddress\" : \"\",\n","stream":"stdout","time":"2021-01-07T23:37:54.053763148Z"} {"log":" \"endpoint\" : \""\n","stream":"stdout","time":"2021-01-07T23:37:54.053767198Z"} {"log":" }\n","stream":"stdout","time":"2021-01-07T23:37:54.053771398Z"} {"log":"}\n","stream":"stdout","time":"2021-01-07T23:37:54.053780998Z"} ... View more

Splunk Connect for Kubernetes is parsing json stri...

by in All Apps and Add-ons
‎01-05-2021 10:23 AM
‎01-05-2021 10:23 AM
We have applications running on OpenShift platform (v 3.11) and logs are written to STDOUT.  We have setup Splunk Connect for Kubernetes to forward logs from OpenShift to Splunk instance. Setup is working and we are able to see and search logs in Splunk but the issue we are facing is that all lines in Application logs are displayed as individual events in Splunk search, for example if there is some json string in logs then each value in json output is displayed as individual events as shown in below screenshot. Here is the raw log:         "sessionInfo" : { "userId" : "", "sessionId" : "bK7xzM16bpLXvaUGaWIODThJm9A", "ipAddress" : "", "endpoint" : "" } }          I suspect some intermediary component between Openshift and splunk is doing this wrapping which might be throwing off the parser, that's my take but I'm not entirely sure about how Splunk Connect for Kubernetes is handling this. Any help/suggestions in fixing is greatly appreciated. Thanks in advance!   Note: Similar app logs which are forwarded to Splunk instance using universal forwarder from linux machine are displayed in correct format in Splunk search. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎01-09-2021 06:21 PM