https://community.splunk.com/t5/Getting-Data-In/Problem-expanding-json-data-in-real-time-search/m-p/22473#M3474 <P>Make sure you hit pause in Real Time if you want to expand an view.</P> Tue, 16 Jul 2013 12:34:05 GMT rickshaw12 2013-07-16T12:34:05Z https://community.splunk.com/t5/Getting-Data-In/Problem-expanding-json-data-in-real-time-search/m-p/22472#M3473 <P>I have some JSON data being fed into splunk which contains data nested a few levels deep. In search with syntax highlighting, Splunk pretty-prints the data and automatically collapses the second-level.</P> <P>The problem:<BR /><BR /> I can expand the nested structure just fine in a non-real-time search, but whenever I expand the structure in a real-time search, it expands for a brief moment, and then collapses itself again.</P> <P><EM>This is with Splunk 5.0</EM></P> Sun, 04 Nov 2012 02:44:23 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-expanding-json-data-in-real-time-search/m-p/22472#M3473 phemmer 2012-11-04T02:44:23Z https://community.splunk.com/t5/Getting-Data-In/Problem-expanding-json-data-in-real-time-search/m-p/22473#M3474 <P>Make sure you hit pause in Real Time if you want to expand an view.</P> Tue, 16 Jul 2013 12:34:05 GMT https://community.splunk.com/t5/Getting-Data-In/Problem-expanding-json-data-in-real-time-search/m-p/22473#M3474 rickshaw12 2013-07-16T12:34:05Z