I am running a query to parse a two-level nested JSON that takes out only the second level dict and puts it in the form of a column. The query works perfectly. However, when I run it, I get this error message from Splunk
This is the query
base search | spath
| foreach *.*
[| eval unknown=if(isnull(unknown),"<<MATCHSEG1>>",mvdedup(mvappend(unknown,"<<MATCHSEG1>>")))]
| fields unknown
| mvexpand unknown
| eval _raw=replace(_raw,"\"".unknown."\"","\"known\"")
| spath path=known| spath input=known | table COLUMN1, COLUMN2,......COLUMN25
"The search you ran returned a number of fields that exceeded the current indexed field extraction limit. To ensure that all fields are extracted for search, set limits.conf: [kv] / indexed_kv_limit to a number that is higher than the number of fields contained in the files that you index."
Could you advise on how I can resolve this issue, please? I am not sure of the no of fields that my query will generate. Any dynamic limit that I can see?
Your help is much appreciated.
