Getting Data In

How to set data model to return a List instead of a String field?

As shown in the screenshot below, sometimes our data has one entry for the geo field and sometimes it has multiple entries for this same field. When our C# Web App issues a query to Splunk and gets results back, we use the Newtonsoft.Json library to help deserialize the JSON result into a C# object.

alt text

However, the issue is that when there is only one geo, Splunk returns a String object; yet when there are multiple geo values, then Splunk returns a List<String>. Since C# & its Newtonsoft.Json library are strongly typed, I would have to create two C# objects: one that handles geo as a String and another that handles geo as a List<String>.

Thus, my question is: Is there a way to force Splunk to always return List<String> for the geo field, even if the length of the list is only one?

0 Karma
1 Solution

Unfortunately, what I wanted to do above in Splunk is not possible.

View solution in original post

0 Karma

Unfortunately, what I wanted to do above in Splunk is not possible.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!