×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
dhuynh
Loves-to-Learn Everything
Member since: ‎06-12-2023
‎06-15-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-12-2023
Activity Feed
View All

Re: json messages not always indexed

by in Getting Data In
‎06-13-2023 04:41 AM
‎06-13-2023 04:41 AM
@nyc_jason  thankyou for your fast reply. when checking the _introspection index I dont see any parsing error. Everything gets parsed correctly. what is weird is that it happens randomly. so when I rerun the process again then the data might be parsed correctly.  ... View more

What is causing json messages to not always be ind...

by in Getting Data In
‎06-12-2023 02:48 PM
‎06-12-2023 02:48 PM
Hi everyone, For one of our client we are sending in json log data via log4j2 to the splunk cloud HEC token. we are using the /event/collector/raw endpoint. What I notice is that the fields are not extracted consistently. We do not see any pattern in our process so we cannot pinpoint the exact location of the issue.  dhuynh_0-1686606054908.png I am using the following source type with its configs: dhuynh_2-1686606398965.png Hopefully can someone see what might cause this issue.   Thankyou in advanced.   Duy     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-15-2023 10:35 AM