json extraction for larger events

[kranthimutyala2]

Hi Team, I have the below JSON field in the splunk event

[{"sourceAccountId":"sourceAccountId_1","Remarks":"Successfully Migrated","recordStatus":"Success","RecordID":"RecordID_1","destinationAccountId":"destinationAccountId_1","defaultOwnerId":"defaultOwnerId_1"},{"sourceAccountId":"sourceAccountId_1","Remarks":"Successfully Migrated","recordStatus":"Success","RecordID":"RecordID_2","destinationAccountId":"destinationAccountId_1","defaultOwnerId":"defaultOwnerId_1"},{"sourceAccountId":"sourceAccountId_1","Remarks":"Successfully Migrated","recordStatus":"Success","RecordID":"RecordID_3","destinationAccountId":"destinationAccountId_1","defaultOwnerId":"defaultOwnerId_1"}]

 just for eg: I have added 3 entries but In real we have more than 200 records in the single event in this field
When im using spath to extract this data its giving blank results, the same data when tested with fewer records (<10) its able to extract all the key value pairs, is there a better way to extract from large event data ??
Please help me with the SPL query.Thanks

 @yuanliu @gcusello 

[sainag_splunk]

I believe you are hitting the limit of extraction_cutoff for spath, maybe. If this is not working, try to set up KV_MODE=JSON on the search head as an alternative for that particular source or sourcetype if you don't have a lot of data coming in.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf

extraction_cutoff = <integer>
* For 'extract-all' spath extraction mode, this setting applies extraction only
  to the first <integer> number of bytes. This setting applies both the auto kv
  extraction and the spath command, when explicitly extracting fields.
* Default: 5000

[ITWhisperer]

@kranthimutyala2 I am a volunteer here, as are most of those providing answers. Please don't tag me in your posts. If I have time and have something to contribute, I will try to help. But I will choose which posts to answer and when.

[kranthimutyala2]

Sure np, I have untagged you and wont tag going forward