Are wildcards supported for JSON?

chustar — Thu, 15 Mar 2018 20:42:38 GMT

I've used the HEC to index some json data that looks kind of like this:

{
    "FieldA_sec": 0.12443,
    "FieldB_sec": 0.10392,
    "FieldC_sec": 0.30292
}

However these two queries give different results:

| stats avg(FieldA_sec) as FieldA_sec_avg, avg(FieldB_sec) as FieldB_sec_avg, avg(FieldC_sec) as FieldC_sec_avg

This query works as expected.

| stats avg(*_sec) as *_sec_avg

This returns the average for only one of my fields.

When inspecting the search log, I found that only some of my fields showed up in the field summary.
The field summary contained 112 fields, but should have over 300 fields.

Is there a limit to the numbers of columns that will be matched in a wildcard when using JSON events?

topic Are wildcards supported for JSON? in Getting Data In

Are wildcards supported for JSON?