topic Re: Search result JSON all fields not being extracted in Getting Data In

Search result JSON all fields not being extracted

pdamjanovic — Wed, 30 Sep 2020 03:18:36 GMT

I have a JSON within my search results whose fields are not being extracted all.
More specifically, a single field within that JSON is much longer than others - 40k characters, other are all under 50 characters. When I try to query any field which is above the long one in specific JSON, I do get a result. However, if I query any fields which is below the long one, no results are returned. Example:
{
"field1":"value1",
"field2":"value2",
"long_field":"............",
"field4":"value4"
}
I can query by field1 and field2 but not long_field and field4. Also, when I add "| fields *" to the query, only field1 and field2 would be among "Interesting fields" select or the results table.

The JSON itself is roughly 30-35 KB in size.

What could be the possible reason for such behavior?

Re: Search result JSON all fields not being extracted

to4kawa — Wed, 11 Dec 2019 13:49:04 GMT

How is spath result?

Re: Search result JSON all fields not being extracted

starcher — Wed, 30 Sep 2020 03:21:32 GMT

Set kv_mode=JSON on the sourcetype definition in props. Do not rely on kv_mode=AUTO

Re: Search result JSON all fields not being extracted

pdamjanovic — Wed, 11 Dec 2019 14:36:17 GMT

Tried, did not help.

Re: Search result JSON all fields not being extracted

pdamjanovic — Wed, 11 Dec 2019 14:36:41 GMT

I'm not quite sure what is the question here?

Re: Search result JSON all fields not being extracted

dindu — Wed, 30 Sep 2020 03:21:39 GMT

Hi,

You might be hitting the max character limits.
The default is near to 10K characters.

Please update the limits.conf.
Do create a limits.conf in your app local directory otherwise it will update the entire Splunk environment
Path - /splunk_home/etc/apps/your_app/local/limits.conf

Please try and let us know the outcome,

 **limits.conf**
 maxchars = <integer>

Re: Search result JSON all fields not being extracted

pdamjanovic — Thu, 12 Dec 2019 09:47:13 GMT

Setting it to 100.000 did not help (message is under 40.000 chars).