Mohit - Thanks for the details. @Graham Watts : I appreciate your help. I used your input to parse fields properly in JSON format without any issues. Thank you very much.
Hi Mohit, No, i am not using any parser in between. Logs are being sent from Symatec ICDX to SUMO in syslog format . I was hoping SUMO will understand the syslog format and parse fields accordingly...