I've used the HEC to index some json data that looks kind of like this:
{
"FieldA_sec": 0.12443,
"FieldB_sec": 0.10392,
"FieldC_sec": 0.30292
}
However these two queries give different results:
| stats avg(FieldA_sec) as FieldA_sec_avg, avg(FieldB_sec) as FieldB_sec_avg, avg(FieldC_sec) as FieldC_sec_avg
This query works as expected.
| stats avg(*_sec) as *_sec_avg
This returns the average for only one of my fields.
When inspecting the search log, I found that only some of my fields showed up in the field summary.
The field summary contained 112 fields, but should have over 300 fields.
Is there a limit to the numbers of columns that will be matched in a wildcard when using JSON events?
