Getting Data In

Is there a bug in Splunk 6 with adding an attribute of an object in data models for a JSON field name containing curly brackets?

dominicwood
Engager

I'm trying to create an object and add some auto-extracted attributes. Some field names contain curly braces because our JSON data contains array structures. As the screenshot shows, the field name is facts.authorizations{}.authorization.expiry.

When implementing a Splunk search, using this field name works perfectly fine; and this is also automatically generated in the list of attributes. However, when I select this field to be added into an attribute, Splunk generates an error message stating "Field Name cannot contain whitespace, double quotes, single quotes, curly braces or asterisks", which prevents me from adding this attribute.

I wonder if this is a bug in Splunk? Should the constraints on field name be applied to the rename field name instead of the indexed field?

Please also suggest any remedy to this problem. Thanks a lot.

alt text

1 Solution

masonmorales
Influencer

I would create a field alias, and then add the field alias to the data model as an attribute instead of the original field name. See: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Addaliasestofields

View solution in original post

masonmorales
Influencer

I would create a field alias, and then add the field alias to the data model as an attribute instead of the original field name. See: http://docs.splunk.com/Documentation/Splunk/6.2.5/Knowledge/Addaliasestofields

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...