topic Re: How to set data model to return a List instead of a String field? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-model-to-return-a-List-instead-of-a-String-field/m-p/423096#M74316 <P>Unfortunately, what I wanted to do above in Splunk is not possible.</P> Tue, 05 Jun 2018 02:22:25 GMT emiliavanderwer 2018-06-05T02:22:25Z How to set data model to return a List instead of a String field? https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-model-to-return-a-List-instead-of-a-String-field/m-p/423095#M74315 <P>As shown in the screenshot below, sometimes our data has one entry for the <CODE>geo</CODE> field and sometimes it has multiple entries for this same field. When our C# Web App issues a query to Splunk and gets results back, we use the Newtonsoft.Json library to help deserialize the JSON result into a C# object.</P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5061i34D3BCB683EA48E4/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>However, the issue is that when there is only one <CODE>geo</CODE>, Splunk returns a <CODE>String</CODE> object; yet when there are multiple <CODE>geo</CODE> values, then Splunk returns a <CODE>List&lt;String&gt;</CODE>. Since C# &amp; its Newtonsoft.Json library are strongly typed, I would have to create two C# objects: one that handles <CODE>geo</CODE> as a <CODE>String</CODE> and another that handles <CODE>geo</CODE> as a <CODE>List&lt;String&gt;</CODE>.</P> <P><STRONG>Thus, my question is: Is there a way to force Splunk to always return <CODE>List&lt;String&gt;</CODE> for the <CODE>geo</CODE> field, even if the length of the list is only one?</STRONG></P> Wed, 30 May 2018 00:40:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-model-to-return-a-List-instead-of-a-String-field/m-p/423095#M74315 emiliavanderwer 2018-05-30T00:40:31Z Re: How to set data model to return a List instead of a String field? https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-model-to-return-a-List-instead-of-a-String-field/m-p/423096#M74316 <P>Unfortunately, what I wanted to do above in Splunk is not possible.</P> Tue, 05 Jun 2018 02:22:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-model-to-return-a-List-instead-of-a-String-field/m-p/423096#M74316 emiliavanderwer 2018-06-05T02:22:25Z