Hello,
I'm struggling with finding a parser in splunk for the following log:
May 20 12:22:21 127.0.0.1 {"rootId": "AXIxikL8ao-yaSvA", "requestId": "f6a873jkjjkjk:-8000:5738", "details": {"flag": false, "title": "task 1", "status": "Waiting", "group": "", "order": 0}, "operation": "Creation", "objectId": "AXIyCN5Oao-H5aYyaSvd", "startDate": 1589977341890, "objectType": "case_task", "base": true, "object": {"_routing": "AXIxikL8ao-H5aYyaSvA", "flag": false, "_type": "case_task", "title": "task 1", "createdAt": 1589977341516, "_parent": "AXIxikL8ao-H5aYyaSvA", "createdBy": "user", "_id": "AXIyCN5Oao-H5aYyaSvd", "id": "AXIyCN5Oao-H5aYyaSvd", "_version": 1, "order": 0, "status": "Waiting", "group": ""}}
The log itself is a valid json, and i can parse it well with the default _json parser. However, splunk inserts the datetime and hostname at the beginning of the log, which makes the parser stop working..
Is there any workaround for this?
Thanks!
... View more