OA69792: LOG RECORDS BEGINNING WITH A TIMESTAMP ENCLOSED IN SQUARE BRACKETS, ARE INCORRECTLY SENT TO SPLUNK.

APAR status

• Closed as duplicate of another APAR.

Error description

• The JSON detection logic in BaseFormatter.java incorrectly
  interpreted any record that started with [ and ended with ] as a
  JSON array. As a result, timestamp-based log entries were
  classified as JSON and routed through the JSON formatter (_JSON)
  instead of the key-value formatter (_KV).
  
  Existing Logic
  
  isJSONFormat() determines the routing based on simple bracket
  checks:
  
  str.startsWith("{") && str.endsWith("}") // JSON object
  str.startsWith("[") && str.endsWith("]") // JSON array
  
  If either condition is met, the record is routed to
  formatJSON(). Otherwise, it is routed to formatCSV().
  

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

• Fixed in CDP 3QPTF APAR OA69689
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels