Getting Data In

duplicate host field when _raw is json

schose
Builder

Hi all,

I'm having non-indexed-extracted json in events. When there is a json "host" field host, which is different from the indexed "host", then the search view is showing you 2 values for host in smart or verbose mode.

Bildschirmfoto 2021-01-13 um 18.07.19.png

you can't work with the searchtime extracted json host field - clicking on it gives you no results - as host is an indexed field. 
.. when you are doing a ... | stats count by host, then only "indextimehost" is reported back - as expected.  

this behaviour differers from "normal" kv searchtime detection:

Bildschirmfoto 2021-01-13 um 18.12.01.png

 

i found multiple posts regarding this like:

https://community.splunk.com/t5/Getting-Data-In/Duplicate-host-field-after-indexing-JSON-event/m-p/2...

unfortunately i'm not able to change the json field name at the source. Rewriting is also no good option for me. 

This more looks like a display bug for me.. but drives the poweruser crasy.  

best Regards,

Andreas

Labels (3)
0 Karma

to4kawa
Ultra Champion

 

index=_internal | head 1 | fields _raw host
| eval _raw="{\"host\": \"your host\"}"
| spath

 

https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Automatickey-valuefieldextractionsatsea...

In default, KV_MODE=auto. so json is extracted, so if the event has the same name, it will inevitably become.

 

index=_internal | head 1 | fields _raw host
| eval _raw="{\"host\": \"your host\"}"
| eval hostname=spath(_raw,"host")

 

how about this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...