Hi, @sainag_splunk  My problem is still remained. Sorry for that your solution didn't solve my problem...  I tried some cases more, will ask about I tried cases. By the way, I have another question for this issue. I tried to change the props.conf for json parsing, "KV_MODE=json" -> "KV_MODE=none" Add "INDEXED_EXTRACTIONS=json" But I think there are errors in parsing to json.  Why this errors was occurred?? My search query is index=_internal JsonLineBreaker NOT StreamedSearch And results show many below lines. 10-10-2024 13:05:55.318 +0900 ERROR JsonLineBreaker [2427 structuredparsing] - JSON StreamId:8181676460594335103 had parsing error:Unexpected character while looking for value: '}' - data_source="*****.json", data_host="****", data_sourcetype="my_json" host = **** source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd 10-10-2024 13:05:55.315 +0900 ERROR JsonLineBreaker [2427 structuredparsing] - JSON StreamId:8181676460594335103 had parsing error:Unexpected character while looking for value: '}' - data_source="*****.json", data_host="****", data_sourcetype="my_json" host = **** source = /opt/splunkforwarder/var/log/splunk/splunkd.log sourcetype = splunkd ... I checked the json file, but there is no invalid characters in json. Also, I tried to parse json in Python or JsonParseWebEditor,,, there is no problems. Why this logs are remained?? ... View more

Dear @sainag_splunk  I tried using the below props.conf: DATETIME_CONFIG = KV_MODE = json LINE_BREAKER = (?:,)([\r\n]+)) NO_BINARY_CHECK = true TIMESTAMP_FIELDS = _time TIME_FORMAT = %2Y%m%d%H%M%S TRUNCATE = 0 category = Structured description = my json type without truncate disabled = false pulldown_type = 1 MAX_EVENTS=1000000 SHOULD_LINE_MERGE = false  But is was same. Umm... I wonder something for your answer,  I applied it deployer server, It will deploy to apps for all of Universal Forwarder.  So if I set the inputs.conf as a below: [batch://C:\splunk\my_data\*.json] index=myIndex sourcetype=my_json crcSalt=<SOURCE> move_policy = sinkhole   The app which address this inputs.conf has above props.conf. However, your answer's concept is not this applied, isn't it? How to apply your answer in my system..? I hope you help me in detail, I'm sorry for I'm begineer in splunk.   My system has 3 search heads, 1 is splunk app, 2 is cluster master and 3 is deployer. In this, 5 indexers.. So the client which is installed UF will send the data to 5 indexers with L/B, and We search in 3 search heads, the results are shown.   Please help me, Thank you. ... View more