Getting Data In

Are wildcards supported for JSON?

Path Finder

I've used the HEC to index some json data that looks kind of like this:

    "FieldA_sec": 0.12443,
    "FieldB_sec": 0.10392,
    "FieldC_sec": 0.30292

However these two queries give different results:

| stats avg(FieldA_sec) as FieldA_sec_avg, avg(FieldB_sec) as FieldB_sec_avg, avg(FieldC_sec) as FieldC_sec_avg

This query works as expected.

| stats avg(*_sec) as *_sec_avg

This returns the average for only one of my fields.

When inspecting the search log, I found that only some of my fields showed up in the field summary.
The field summary contained 112 fields, but should have over 300 fields.

Is there a limit to the numbers of columns that will be matched in a wildcard when using JSON events?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...