I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following:
[sourcetype_name]
TRUNCATE = 0
BREAK_ONLY_BEFORE_DATE = false
DATETIME_CONFIG = NONE
MAX_TIMESTAMP_LOOKAHEAD = 0
INDEXED_EXTRACTIONS = JSON
I'm starting to think that it's a bug on Windows UFs.
↧