As seen in https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTUM/RESTusing#Example_B:_JSON_response_format_..., there is a field added to the json output that is called "preview". I've never seen it be anything other than "false". Does anyone know what this field is, and whether I can remove it from the output?
It's not even valid JSON you're exporting but, the rational for how and why these preview fields are there is explained in this answer
My link disappeared above but here it is: https://answers.splunk.com/answers/65932/rest-api-json-invalid-format.html#answer-67814
