Im using splunk enterprise v9.0.2.1 and MQTT modular input app is installed. When receiving json input for MQTT modular input getting
ERROR JsonLineBreaker [1946662 parsing] - JSON StreamId:11645015375736311559 had parsing error:Unexpected character while looking for value: 'W' - data_source="mqtt", data_host="local", data_sourcetype="jklg_json".
jklg_json props.conf:
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = (\{\"message\":.*\})
NO_BINARY_CHECK = true
category = Custom
description = JavaScript Object Notation format. For more information, visit http://json.org/
disabled = false
pulldown_type = 1
SHOULD_LINEMERGE = false
sample json:
{"message":"hi","name":"jklg"}
How to resolve this issue?
... View more
