Getting Data In

Search result JSON all fields not being extracted

pdamjanovic
New Member

I have a JSON within my search results whose fields are not being extracted all.
More specifically, a single field within that JSON is much longer than others - 40k characters, other are all under 50 characters. When I try to query any field which is above the long one in specific JSON, I do get a result. However, if I query any fields which is below the long one, no results are returned. Example:
{
"field1":"value1",
"field2":"value2",
"long_field":"............",
"field4":"value4"
}
I can query by field1 and field2 but not long_field and field4. Also, when I add "| fields *" to the query, only field1 and field2 would be among "Interesting fields" select or the results table.

The JSON itself is roughly 30-35 KB in size.

What could be the possible reason for such behavior?

0 Karma

dindu
Contributor

Hi,

You might be hitting the max character limits.
The default is near to 10K characters.

Please update the limits.conf.
Do create a limits.conf in your app local directory otherwise it will update the entire Splunk environment
Path - /splunk_home/etc/apps/your_app/local/limits.conf

Please try and let us know the outcome,

 **limits.conf**
 maxchars = <integer>
0 Karma

pdamjanovic
New Member

Setting it to 100.000 did not help (message is under 40.000 chars).

0 Karma

starcher
Influencer

Set kv_mode=JSON on the sourcetype definition in props. Do not rely on kv_mode=AUTO

0 Karma

pdamjanovic
New Member

Tried, did not help.

0 Karma

to4kawa
Ultra Champion

How is spath result?

0 Karma

pdamjanovic
New Member

I'm not quite sure what is the question here?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...