Getting Data In

Are wildcards supported for JSON?

chustar
Path Finder

I've used the HEC to index some json data that looks kind of like this:

{
    "FieldA_sec": 0.12443,
    "FieldB_sec": 0.10392,
    "FieldC_sec": 0.30292
}

However these two queries give different results:

| stats avg(FieldA_sec) as FieldA_sec_avg, avg(FieldB_sec) as FieldB_sec_avg, avg(FieldC_sec) as FieldC_sec_avg

This query works as expected.

| stats avg(*_sec) as *_sec_avg

This returns the average for only one of my fields.

When inspecting the search log, I found that only some of my fields showed up in the field summary.
The field summary contained 112 fields, but should have over 300 fields.

Is there a limit to the numbers of columns that will be matched in a wildcard when using JSON events?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>