Getting Data In

Search result JSON all fields not being extracted

pdamjanovic
New Member

I have a JSON within my search results whose fields are not being extracted all.
More specifically, a single field within that JSON is much longer than others - 40k characters, other are all under 50 characters. When I try to query any field which is above the long one in specific JSON, I do get a result. However, if I query any fields which is below the long one, no results are returned. Example:
{
"field1":"value1",
"field2":"value2",
"long_field":"............",
"field4":"value4"
}
I can query by field1 and field2 but not long_field and field4. Also, when I add "| fields *" to the query, only field1 and field2 would be among "Interesting fields" select or the results table.

The JSON itself is roughly 30-35 KB in size.

What could be the possible reason for such behavior?

0 Karma

dindu
Contributor

Hi,

You might be hitting the max character limits.
The default is near to 10K characters.

Please update the limits.conf.
Do create a limits.conf in your app local directory otherwise it will update the entire Splunk environment
Path - /splunk_home/etc/apps/your_app/local/limits.conf

Please try and let us know the outcome,

 **limits.conf**
 maxchars = <integer>
0 Karma

pdamjanovic
New Member

Setting it to 100.000 did not help (message is under 40.000 chars).

0 Karma

starcher
Influencer

Set kv_mode=JSON on the sourcetype definition in props. Do not rely on kv_mode=AUTO

0 Karma

pdamjanovic
New Member

Tried, did not help.

0 Karma

to4kawa
Ultra Champion

How is spath result?

0 Karma

pdamjanovic
New Member

I'm not quite sure what is the question here?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...