About vegerlandecs

mitag · ‎10-07-2020

Splunk will ingest this data type natively as long as it passes JSON validation. (Some tweaking may be needed, such to specify the fieldname of the timestamp.) In my case, the JSON contained errors, did not pass JSON validation and thus could not be ingested by Splunk.

vegerlandecs · ‎09-30-2020

@vj5 SEDCMD is the kind of option that is not processed by universal forwarders. ref: https://wiki.splunk.com/Community:HowIndexingWorks, very last image shows as it's part of the typing processor - which only enterprise installations (HF and IDX) will have. Also, Splunk uses PCRE notation, so \u is not supported. From the snippets it isn't very clear to me what are you trying to SED, but consider this replacement regex as a start: SEDCMD-1_unjsonify = s/log:\s+?{.*?{(.*?)}/\1/g

ridwanahmed · ‎12-13-2019

Is there a reason (beyond the obvious complaint in the log) to use parsingQueue instead of: [queue] maxSize = 2MB

Posts	6
Solutions	1
Karma Given	5
Karma Received	2
Member Since	‎06-09-2017

Online Status	Offline
Date Last Visited	‎09-30-2020 05:03 AM

JSON parsing error in the universal forwarder

Re: ingesting a large list of JSONs as separate ev...

Re: JSON parsing error in the universal forwarder

Re: Could not send data to output queue (parsingQu...