https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354665#M64871 <P>So you have JSON files being ingested, but not all fields/portions are being extracted?</P> <P>Do you need an extraction that's not part of the KV extraction Splunk does when the sourcetype is set to JSON (e.g. extracting from an existing field or slicing and dicing a field into "subfields" that aren't JSON defined?)</P> <P>Or are there NO fields extracted from this JSON file and you need to extract some?</P> <P>In the former case, if you were to paste in an example of the field and the sub-value you want out of it I'm sure we can help you with a regex based extraction to handle that.</P> <P>If the latter case, why not set it to JSON and let Splunk extract it?</P> Sat, 03 Feb 2018 13:59:17 GMT Richfez 2018-02-03T13:59:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354663#M64869 <P>I’ve got some JSON logs pulling into Splunk and I’m trying to do the field extraction on one of the logs I’ve gathered. However, whenever it goes to the "Extract Fields" screen it only shows about 1/3 (top part) of the log. All of the pertinent data is not visible. Is there a setting or process to make the whole log viewable for field extraction?</P> <P>Thanks in advance!<BR /> s_R</P> Fri, 02 Feb 2018 20:45:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354663#M64869 sir_real 2018-02-02T20:45:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354664#M64870 <P>How many bytes long is your JSON event? I believe there is a default limit involved.</P> Sat, 03 Feb 2018 04:24:04 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354664#M64870 micahkemp 2018-02-03T04:24:04Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354665#M64871 <P>So you have JSON files being ingested, but not all fields/portions are being extracted?</P> <P>Do you need an extraction that's not part of the KV extraction Splunk does when the sourcetype is set to JSON (e.g. extracting from an existing field or slicing and dicing a field into "subfields" that aren't JSON defined?)</P> <P>Or are there NO fields extracted from this JSON file and you need to extract some?</P> <P>In the former case, if you were to paste in an example of the field and the sub-value you want out of it I'm sure we can help you with a regex based extraction to handle that.</P> <P>If the latter case, why not set it to JSON and let Splunk extract it?</P> Sat, 03 Feb 2018 13:59:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-whole-JSON-logs-for-field-extraction-in-Splunk-since/m-p/354665#M64871 Richfez 2018-02-03T13:59:17Z