- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a limit on json arrays?
marcokrueger
Path Finder
04-29-2013
02:32 AM
Hi,
I import a json-file with a json-object that contains an array with another 50 json-objects. It looks like, that the (multiline) event is not read in till to the end, but my truncate and max_events are big enough.
I have SHOULD_LINEMERGE = true, truncate=0 and max_events=10000. Is there perhaps another (hidden) parameter to control event-length or json-objects?
best regards
Marco
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

woodcock
Esteemed Legend
10-14-2015
12:29 PM
According to this answer, there is a limit if you use INDEXED EXTRACTIONS = JSON
but not if you use KV_MODE = json
:
https://answers.splunk.com/answers/319059/indexed-extractions-json-limiting-multivalued-fiel.html
