Hi With UF I suppose that the easiest way is use modify the producer so that it writes only those needed events on that json. I suppose that there is some program which continuously writes this file one event per line? With HF, you could use props and transforms for get ride of unwanted values. r. Ismo ... View more

For reference:    https://community.splunk.com/t5/All-Apps-and-Add-ons/8-0-6-REST-API-call-fails-with-error-after-upgrade/m-p/520944  ... View more