Your data looks like json, check what is your sourcetype (and if on the forwarder it has a INDEXED_EXTRACTIONS=json in props.conf for the sourcetype) If it's the case we should expect an automatic json event breaking. ... View more

When a python script uses import inside the custom data handler, where does it look to find it? Is it in here: /opt/splunk/etc/apps/protocol_ta/bin/vertx_modules/io.vertx~lang-jython~2.1.1/ ? I am getting errors inside splunkd.log when I save the Protocol Data Input, so it looks like it is trying. ... View more