As shown in the screenshot below, sometimes our data has one entry for the geo field and sometimes it has multiple entries for this same field. When our C# Web App issues a query to Splunk and gets results back, we use the Newtonsoft.Json library to help deserialize the JSON result into a C# object.
However, the issue is that when there is only one geo, Splunk returns a String object; yet when there are multiple geo values, then Splunk returns a List<String>. Since C# & its Newtonsoft.Json library are strongly typed, I would have to create two C# objects: one that handles geo as a String and another that handles geo as a List<String>.
Thus, my question is: Is there a way to force Splunk to always return List<String> for the geo field, even if the length of the list is only one?
