duplicate host field when _raw is json

schose — Wed, 13 Jan 2021 17:27:32 GMT

Hi all,

I'm having non-indexed-extracted json in events. When there is a json "host" field host, which is different from the indexed "host", then the search view is showing you 2 values for host in smart or verbose mode.

you can't work with the searchtime extracted json host field - clicking on it gives you no results - as host is an indexed field.
.. when you are doing a ... | stats count by host, then only "indextimehost" is reported back - as expected.

this behaviour differers from "normal" kv searchtime detection:

i found multiple posts regarding this like:

https://community.splunk.com/t5/Getting-Data-In/Duplicate-host-field-after-indexing-JSON-event/m-p/292472

unfortunately i'm not able to change the json field name at the source. Rewriting is also no good option for me.

This more looks like a display bug for me.. but drives the poweruser crasy.

best Regards,

Andreas

Re: duplicate host field when _raw is json

to4kawa — Sat, 16 Jan 2021 00:08:39 GMT

index=_internal | head 1 | fields _raw host | eval _raw="{\"host\": \"your host\"}" | spath

https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Automatickey-valuefieldextractionsatsearch-time

In default, KV_MODE=auto. so json is extracted, so if the event has the same name, it will inevitably become.

index=_internal | head 1 | fields _raw host | eval _raw="{\"host\": \"your host\"}" | eval hostname=spath(_raw,"host")

how about this?

topic duplicate host field when _raw is json in Getting Data In

duplicate host field when _raw is json

Re: duplicate host field when _raw is json