https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Hubs-JSON-data-and-limiting-data/m-p/515891#M63141 <P>I'm using the Microsoft Azure add on for splunk to read from event hub in Azure.&nbsp; &nbsp;I am using Splunk cloud and a heavy fowarder in Azure.</P> <P>Two Problems,</P> <P>1st.&nbsp; &nbsp; The data showing up is one big field of JSON.&nbsp; I've tried to extract in splunk cloud, but its getting mangled.</P> <P>2nd.&nbsp; Can i limit this.&nbsp; 75% of my fields are useless and and taking up space.</P> <P>Can anyone help me out with either issue?</P> <P>I am using a heavy fwd'r.&nbsp; &nbsp; Splunk support does tell me to use spath.&nbsp; &nbsp;But how do i do this in parsing event hub data?&nbsp; &nbsp;Do i need&nbsp; different addon?</P> Tue, 25 Aug 2020 02:44:34 GMT zippo706 2020-08-25T02:44:34Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Hubs-JSON-data-and-limiting-data/m-p/515891#M63141 <P>I'm using the Microsoft Azure add on for splunk to read from event hub in Azure.&nbsp; &nbsp;I am using Splunk cloud and a heavy fowarder in Azure.</P> <P>Two Problems,</P> <P>1st.&nbsp; &nbsp; The data showing up is one big field of JSON.&nbsp; I've tried to extract in splunk cloud, but its getting mangled.</P> <P>2nd.&nbsp; Can i limit this.&nbsp; 75% of my fields are useless and and taking up space.</P> <P>Can anyone help me out with either issue?</P> <P>I am using a heavy fwd'r.&nbsp; &nbsp; Splunk support does tell me to use spath.&nbsp; &nbsp;But how do i do this in parsing event hub data?&nbsp; &nbsp;Do i need&nbsp; different addon?</P> Tue, 25 Aug 2020 02:44:34 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Event-Hubs-JSON-data-and-limiting-data/m-p/515891#M63141 zippo706 2020-08-25T02:44:34Z