Mixing
Splunk Enterprise: large json events not indexed
0
I have a sourcetype defined like this (systemlocalprops.conf):
[my_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = Timestamp
category = Structured
description = json
disabled = false
pulldown_type = 1
TIME_FORMAT = HH:mm:ss.fff
LINE_BREAKER = ([rn]+)
limits.conf:
[spath]
# Number of characters to read from an XML or JSON event when
# auto extracting.
extraction_cutoff = 5000
extract_all = true
If I try to index following json (no line breaks, I just formated it here):
{
"Timestamp": "19:51:27.757",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "19",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "7C217CF0CC45E0292623203E56AD87EC",
"ApiType": "android",
"ApiVersion": "6.0",
"AppVersion": "1.0.debug",
"UserId": 25714,
"SessionId": 1440538,
"CorrelationId": "98ccaec5-4d23-4c5f-b5da-7ce0e440f2e3"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": null,
"CanRun": true,
"PhoneNumber": null,
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": null,
"RegisterationPhoneNumber": null,
"Favourites": null,
"SessionId": "4DC24EB6E4B0261DD03CDD4F6A7C7DC8",
"IsFriendlyCustomer": true,
"OptionsAvailable": ,
"MaxOrderDate": null,
"FavouriteDriverNumber": null,
"ShareMessage": null,
"PaymentInstruments": ,
"InAppPaymentAvailable": true,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": null
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
it gets properly indexed. But the following one does NOT get indexed:
{
"Timestamp": "16:31:27.074",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "5",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "A70BAFD855CE7120A8E331E27D39E645",
"ApiType": "MOCK",
"ApiVersion": "1.0",
"AppVersion": null,
"UserId": 11852,
"SessionId": 448107,
"CorrelationId": "28d9cc6f-c207-4199-9c24-ac6c4b4cfc8e"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": "message",
"CanRun": false,
"PhoneNumber": "48600000000",
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": "",
"RegisterationPhoneNumber": null,
"Favourites": ,
"SessionId": "0778662D04444C9456694B3FAB44F8C6",
"IsFriendlyCustomer": true,
"OptionsAvailable": [
"PaymentCard",
"Combi",
"SevenSeats",
"Animal",
"AirContition"
],
"MaxOrderDate": "2019-01-30 16:31",
"FavouriteDriverNumber": null,
"ShareMessage": "some long share message. http://www.sharing.net.pl/",
"PaymentInstruments": ,
"InAppPaymentAvailable": false,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": "Zwr klucz sesji dla zarejestrowanego uzytkownika"
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
UPDATE:
This is what I have found in logs:
01-02-2019 20:40:31.780 +0100 ERROR JsonLineBreaker - JSON StreamId:9928927958268928125 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="C:LogsTxxx.log", data_host="WIN-BP2MBISNI04", data_sourcetype="my_json"
json splunk
asked Jan 2 at 11:02
MarcinMarcin
2581321
add a comment |
0
I have a sourcetype defined like this (systemlocalprops.conf):
[my_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = Timestamp
category = Structured
description = json
disabled = false
pulldown_type = 1
TIME_FORMAT = HH:mm:ss.fff
LINE_BREAKER = ([rn]+)
limits.conf:
[spath]
# Number of characters to read from an XML or JSON event when
# auto extracting.
extraction_cutoff = 5000
extract_all = true
If I try to index following json (no line breaks, I just formated it here):
{
"Timestamp": "19:51:27.757",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "19",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "7C217CF0CC45E0292623203E56AD87EC",
"ApiType": "android",
"ApiVersion": "6.0",
"AppVersion": "1.0.debug",
"UserId": 25714,
"SessionId": 1440538,
"CorrelationId": "98ccaec5-4d23-4c5f-b5da-7ce0e440f2e3"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": null,
"CanRun": true,
"PhoneNumber": null,
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": null,
"RegisterationPhoneNumber": null,
"Favourites": null,
"SessionId": "4DC24EB6E4B0261DD03CDD4F6A7C7DC8",
"IsFriendlyCustomer": true,
"OptionsAvailable": ,
"MaxOrderDate": null,
"FavouriteDriverNumber": null,
"ShareMessage": null,
"PaymentInstruments": ,
"InAppPaymentAvailable": true,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": null
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
it gets properly indexed. But the following one does NOT get indexed:
{
"Timestamp": "16:31:27.074",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "5",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "A70BAFD855CE7120A8E331E27D39E645",
"ApiType": "MOCK",
"ApiVersion": "1.0",
"AppVersion": null,
"UserId": 11852,
"SessionId": 448107,
"CorrelationId": "28d9cc6f-c207-4199-9c24-ac6c4b4cfc8e"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": "message",
"CanRun": false,
"PhoneNumber": "48600000000",
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": "",
"RegisterationPhoneNumber": null,
"Favourites": ,
"SessionId": "0778662D04444C9456694B3FAB44F8C6",
"IsFriendlyCustomer": true,
"OptionsAvailable": [
"PaymentCard",
"Combi",
"SevenSeats",
"Animal",
"AirContition"
],
"MaxOrderDate": "2019-01-30 16:31",
"FavouriteDriverNumber": null,
"ShareMessage": "some long share message. http://www.sharing.net.pl/",
"PaymentInstruments": ,
"InAppPaymentAvailable": false,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": "Zwr klucz sesji dla zarejestrowanego uzytkownika"
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
UPDATE:
This is what I have found in logs:
01-02-2019 20:40:31.780 +0100 ERROR JsonLineBreaker - JSON StreamId:9928927958268928125 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="C:LogsTxxx.log", data_host="WIN-BP2MBISNI04", data_sourcetype="my_json"
json splunk
asked Jan 2 at 11:02
MarcinMarcin
2581321
TheTIME_FORMATsetting is incorrect. It should be "%H:%M:%S.%3N". Also, you should addTIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.
– RichG
Jan 2 at 12:41
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38
add a comment |
0
0
0
I have a sourcetype defined like this (systemlocalprops.conf):
[my_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = Timestamp
category = Structured
description = json
disabled = false
pulldown_type = 1
TIME_FORMAT = HH:mm:ss.fff
LINE_BREAKER = ([rn]+)
limits.conf:
[spath]
# Number of characters to read from an XML or JSON event when
# auto extracting.
extraction_cutoff = 5000
extract_all = true
If I try to index following json (no line breaks, I just formated it here):
{
"Timestamp": "19:51:27.757",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "19",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "7C217CF0CC45E0292623203E56AD87EC",
"ApiType": "android",
"ApiVersion": "6.0",
"AppVersion": "1.0.debug",
"UserId": 25714,
"SessionId": 1440538,
"CorrelationId": "98ccaec5-4d23-4c5f-b5da-7ce0e440f2e3"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": null,
"CanRun": true,
"PhoneNumber": null,
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": null,
"RegisterationPhoneNumber": null,
"Favourites": null,
"SessionId": "4DC24EB6E4B0261DD03CDD4F6A7C7DC8",
"IsFriendlyCustomer": true,
"OptionsAvailable": ,
"MaxOrderDate": null,
"FavouriteDriverNumber": null,
"ShareMessage": null,
"PaymentInstruments": ,
"InAppPaymentAvailable": true,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": null
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
it gets properly indexed. But the following one does NOT get indexed:
{
"Timestamp": "16:31:27.074",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "5",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "A70BAFD855CE7120A8E331E27D39E645",
"ApiType": "MOCK",
"ApiVersion": "1.0",
"AppVersion": null,
"UserId": 11852,
"SessionId": 448107,
"CorrelationId": "28d9cc6f-c207-4199-9c24-ac6c4b4cfc8e"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": "message",
"CanRun": false,
"PhoneNumber": "48600000000",
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": "",
"RegisterationPhoneNumber": null,
"Favourites": ,
"SessionId": "0778662D04444C9456694B3FAB44F8C6",
"IsFriendlyCustomer": true,
"OptionsAvailable": [
"PaymentCard",
"Combi",
"SevenSeats",
"Animal",
"AirContition"
],
"MaxOrderDate": "2019-01-30 16:31",
"FavouriteDriverNumber": null,
"ShareMessage": "some long share message. http://www.sharing.net.pl/",
"PaymentInstruments": ,
"InAppPaymentAvailable": false,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": "Zwr klucz sesji dla zarejestrowanego uzytkownika"
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
UPDATE:
This is what I have found in logs:
01-02-2019 20:40:31.780 +0100 ERROR JsonLineBreaker - JSON StreamId:9928927958268928125 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="C:LogsTxxx.log", data_host="WIN-BP2MBISNI04", data_sourcetype="my_json"
json splunk
asked Jan 2 at 11:02
MarcinMarcin
2581321
I have a sourcetype defined like this (systemlocalprops.conf):
[my_json]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = json
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = Timestamp
category = Structured
description = json
disabled = false
pulldown_type = 1
TIME_FORMAT = HH:mm:ss.fff
LINE_BREAKER = ([rn]+)
limits.conf:
[spath]
# Number of characters to read from an XML or JSON event when
# auto extracting.
extraction_cutoff = 5000
extract_all = true
If I try to index following json (no line breaks, I just formated it here):
{
"Timestamp": "19:51:27.757",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "19",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "7C217CF0CC45E0292623203E56AD87EC",
"ApiType": "android",
"ApiVersion": "6.0",
"AppVersion": "1.0.debug",
"UserId": 25714,
"SessionId": 1440538,
"CorrelationId": "98ccaec5-4d23-4c5f-b5da-7ce0e440f2e3"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": null,
"CanRun": true,
"PhoneNumber": null,
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": null,
"RegisterationPhoneNumber": null,
"Favourites": null,
"SessionId": "4DC24EB6E4B0261DD03CDD4F6A7C7DC8",
"IsFriendlyCustomer": true,
"OptionsAvailable": ,
"MaxOrderDate": null,
"FavouriteDriverNumber": null,
"ShareMessage": null,
"PaymentInstruments": ,
"InAppPaymentAvailable": true,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": null
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
it gets properly indexed. But the following one does NOT get indexed:
{
"Timestamp": "16:31:27.074",
"Level": "INFO",
"EventType": "Audit",
"EventId": "ApiServiceInvocationResponse",
"ThreadId": "5",
"Method": "TXXXX1234.Common.WCF.ParameterInspector.AfterCall",
"Context": {
"PhoneNumber": "48600000000",
"ApplicationId": "A70BAFD855CE7120A8E331E27D39E645",
"ApiType": "MOCK",
"ApiVersion": "1.0",
"AppVersion": null,
"UserId": 11852,
"SessionId": 448107,
"CorrelationId": "28d9cc6f-c207-4199-9c24-ac6c4b4cfc8e"
},
"Payload": {
"Operation": "Initialize",
"Response": {
"Message": "message",
"CanRun": false,
"PhoneNumber": "48600000000",
"DefaultPhoneNumber": "48600000000",
"DriverPhoneNumber": "",
"RegisterationPhoneNumber": null,
"Favourites": ,
"SessionId": "0778662D04444C9456694B3FAB44F8C6",
"IsFriendlyCustomer": true,
"OptionsAvailable": [
"PaymentCard",
"Combi",
"SevenSeats",
"Animal",
"AirContition"
],
"MaxOrderDate": "2019-01-30 16:31",
"FavouriteDriverNumber": null,
"ShareMessage": "some long share message. http://www.sharing.net.pl/",
"PaymentInstruments": ,
"InAppPaymentAvailable": false,
"HasActiveOrders": false,
"UserName": "some name",
"UserPhone": "48600000000",
"ApplicationId": "",
"KioskInfo": null,
"CallResult": {
"Code": "SSREA",
"Message": "Zwr klucz sesji dla zarejestrowanego uzytkownika"
}
},
"truncate": false
},
"Message": null,
"Exception": null
}
UPDATE:
This is what I have found in logs:
01-02-2019 20:40:31.780 +0100 ERROR JsonLineBreaker - JSON StreamId:9928927958268928125 had parsing error:Unexpected character while parsing backslash escape: 'x' - data_source="C:LogsTxxx.log", data_host="WIN-BP2MBISNI04", data_sourcetype="my_json"
json splunk
json splunk
asked Jan 2 at 11:02
MarcinMarcin
2581321
asked Jan 2 at 11:02
MarcinMarcin
2581321
edited Jan 2 at 19:57
Marcin
asked Jan 2 at 11:02
MarcinMarcin
2581321
asked Jan 2 at 11:02
MarcinMarcin
2581321
asked Jan 2 at 11:02
MarcinMarcin
2581321
2581321
TheTIME_FORMATsetting is incorrect. It should be "%H:%M:%S.%3N". Also, you should addTIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.
– RichG
Jan 2 at 12:41
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38
add a comment |
TheTIME_FORMATsetting is incorrect. It should be "%H:%M:%S.%3N". Also, you should addTIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.
– RichG
Jan 2 at 12:41
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38
The
TIME_FORMAT setting is incorrect. It should be "%H:%M:%S.%3N". Also, you should add TIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.– RichG
Jan 2 at 12:41
The
TIME_FORMAT setting is incorrect. It should be "%H:%M:%S.%3N". Also, you should add TIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.– RichG
Jan 2 at 12:41
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38
add a comment |
1 Answer
1
active
oldest
votes
0
Try adding CHARSET = UTF-8 to the props.conf stanza.
answered Jan 2 at 18:16
RichGRichG
9461611
did not help...
– Marcin
Jan 2 at 19:55
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005145%2fsplunk-enterprise-large-json-events-not-indexed%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
Try adding CHARSET = UTF-8 to the props.conf stanza.
answered Jan 2 at 18:16
RichGRichG
9461611
did not help...
– Marcin
Jan 2 at 19:55
add a comment |
0
Try adding CHARSET = UTF-8 to the props.conf stanza.
answered Jan 2 at 18:16
RichGRichG
9461611
did not help...
– Marcin
Jan 2 at 19:55
add a comment |
0
0
0
Try adding CHARSET = UTF-8 to the props.conf stanza.
answered Jan 2 at 18:16
RichGRichG
9461611
Try adding CHARSET = UTF-8 to the props.conf stanza.
answered Jan 2 at 18:16
RichGRichG
9461611
answered Jan 2 at 18:16
RichGRichG
9461611
answered Jan 2 at 18:16
RichGRichG
9461611
answered Jan 2 at 18:16
RichGRichG
9461611
9461611
did not help...
– Marcin
Jan 2 at 19:55
add a comment |
did not help...
– Marcin
Jan 2 at 19:55
did not help...
– Marcin
Jan 2 at 19:55
did not help...
– Marcin
Jan 2 at 19:55
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54005145%2fsplunk-enterprise-large-json-events-not-indexed%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The
TIME_FORMATsetting is incorrect. It should be "%H:%M:%S.%3N". Also, you should addTIME_PREFIX = "TIMESTAMP": ". More likely to cause the problem, however, is the non-ASCII character in the Message field after "zwr". Splunk expects all characters to be UTF-8.– RichG
Jan 2 at 12:41
Time format should not be an issue here because it's the same in both cases. In fact removing this non-ascii character helped - thanks! Anyway this character is utf-8 encoded so why splunk does not want to index it?
– Marcin
Jan 2 at 15:38