Getting Data In

How to find non-json records

ShagVT
Path Finder

I have a bunch of sourcetypes which are supposed to contain only valid JSON data. I've been asked to verify that in fact they do contain only json. Is there an easy/elegant way to search to find records which were not well-formed JSON? (ie, records that Splunk can automatically format as a JSON tree.)

0 Karma

niketn
Legend

@ShagVT if you know the JSON structure like the root node or some other unique pattern, you can use the same to parse and send unwanted data/events to nullQueue (or a separate index) then you can get stats of events pushed to null queue or separate index/sourcetype. https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...