topic Re: On data ingest, does Splunk recognize maps? in Getting Data In

On data ingest, does Splunk recognize maps?

minerjaime — Sat, 28 Nov 2015 13:14:43 GMT

I'm using Splunk to store data tuples that contain maps.

For example, such a map is: {"likes": ["strawberry", "vanilla"], "dislikes": ["chocolate"]}.

Is there a way to get Splunk to recognize this as a map? To identify the keys? To query for specific values?

Thanks!

Re: On data ingest, does Splunk recognize maps?

martin_mueller — Sun, 29 Nov 2015 06:36:26 GMT

That looks like JSON, no big deal to index and have its fields extracted - check out http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata

Re: On data ingest, does Splunk recognize maps?

minerjaime — Mon, 30 Nov 2015 19:31:03 GMT

Martin, thanks.

Yes, it is JSON and I have managed to get Splunk to "handle" it.

However, when this map is extracted, it doesn't behave in the best of ways. I seem to get an "Interesting Field" for every instance of "first" key in the map.

Is there a way to query the maps for certain keys or values?