Getting Data In

duplicate host field when _raw is json

schose
Builder

Hi all,

I'm having non-indexed-extracted json in events. When there is a json "host" field host, which is different from the indexed "host", then the search view is showing you 2 values for host in smart or verbose mode.

Bildschirmfoto 2021-01-13 um 18.07.19.png

you can't work with the searchtime extracted json host field - clicking on it gives you no results - as host is an indexed field. 
.. when you are doing a ... | stats count by host, then only "indextimehost" is reported back - as expected.  

this behaviour differers from "normal" kv searchtime detection:

Bildschirmfoto 2021-01-13 um 18.12.01.png

 

i found multiple posts regarding this like:

https://community.splunk.com/t5/Getting-Data-In/Duplicate-host-field-after-indexing-JSON-event/m-p/2...

unfortunately i'm not able to change the json field name at the source. Rewriting is also no good option for me. 

This more looks like a display bug for me.. but drives the poweruser crasy.  

best Regards,

Andreas

Labels (3)
0 Karma

to4kawa
Ultra Champion

 

index=_internal | head 1 | fields _raw host
| eval _raw="{\"host\": \"your host\"}"
| spath

 

https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Automatickey-valuefieldextractionsatsea...

In default, KV_MODE=auto. so json is extracted, so if the event has the same name, it will inevitably become.

 

index=_internal | head 1 | fields _raw host
| eval _raw="{\"host\": \"your host\"}"
| eval hostname=spath(_raw,"host")

 

how about this?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...