Hi,
Is there a way to tell splunk not to write a particular error message to splunkd.log?
I am getting hit by below error continuously and I can't fix JSON inputs which are coming from external source.
My splunkd.log has only these lines and nothing else.
09-30-2019 14:45:25.717 +1000 ERROR JsonLineBreaker - JSON StreamId:10924785040871047960 had parsing error:Unexpected character: '-' - .......................
My props.conf is like
[my_json]
SEDCMD-strip_prefix = s/^[^{]+//g
INDEXED_EXTRACTIONS=JSON
NO_BINARY_CHECK = true
category = Custom
description = my_json_custom
disabled = false
pulldown_type = true
DATETIME_CONFIG = CURRENT
TRUNCATE = 100000
MAX_EVENTS = 10000
↧