Hi All, I need help in knowing below. There is a field named lvl, which is of type=string. Raw Data : {
"time": "2025-03-10T06:20:29",
"corr": "3hgewhrger2346324632434gjhf",...
See more...
Hi All, I need help in knowing below. There is a field named lvl, which is of type=string. Raw Data : {
"time": "2025-03-10T06:20:29",
"corr": "3hgewhrger2346324632434gjhf",
"dpnt": "test.dpmt",
"appn": "test - appn",
"lvl": "Warn",
"mod": "test.mod",
"tid": "171",
"oper": "SetTestContext",
"rslt": "Succeeded",
"msg": "test msg",
"inst": "test inst",
"x-trace-id": "Root=1-65325bhg-test3;Sampled=1"
} Though lvl is of type string, if I try | search lvl="Warn" or lvl=Warn, it renders no result. Instead if I do | spath lvl and then | search lvl="Warn" or lvl=Warn it is showing result. Whereas for other fields like dpnt which is again of type string, it is working fine with | search dpnt="test.dpmt". I understand spath works on structured data format like json and xml but not getting what is happening in this case. Why is lvl string field not working as expected ? Please can anyone shade some light on this. Thanks, PNV