After parsing my json fields the autoextractedfields have format like this a{}.b and a{}.b{}.c and so on.
When i try to addautoextractedfield to data model I'm getting an exception,
"Field...
I'm new to data models and have a very newbie question. We are using SplunkCloud and when I try to addanauto-extractedfield to the dataset, I only see a partial lists of fields. How do I s...
...names with "space" as well as _ . I don't want to show the fieldnames with "space" when I do "AddAuto-ExtractedField" . Is there a way to disable or hide the old fieldnames that have "space" in t...
I have had a sourcetype working fine for months which used a | as a field delimiter in a CSV file with a header.
Yesterday, the file had a few new fields added to the end of the line (header and d...
...For instance, let's say I have a field "dimension" in a source that a data model is pulling in from via the constraints. Now I add this field via Add Attribute -> AutoExtraction and set the r...
I'm trying to create an object and add some auto-extracted attributes. Some field names contain curly braces because our JSON data contains array structures. As the screenshot shows, the field name i...
We recently upgrade the Add-on for Cisco ASA from versión 3.4.0 to 5.0.0. In versión 3.4.0 KV_MODE was set to Autoand this meant that a lot of informatión from messages from the DAP (734*) was extracted...
...reate a data model you'll get an error message if you choose to add "items{}.category" as anautoextractedfield.
There is a "new" option called JSON_TRIM_BRACES_IN_ARRAY_NAMES https://docs.splunk...
...I stopped the acceleration on the Authentication data model so I could go in and see if I could add the field clientAppUsed, but it's not coming up a field to be added (using the 'AddAuto-Extracted...
Hi,
How to perform a fieldextraction on a field from a lookup table?
I'm trying to addanother field so the data model in Splunk Enterprise Security can recognise the field.
The issue i'm h...