cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
ecd
Explorer
Member since: ‎08-12-2018
‎06-05-2020
Community Statistics
Posts 3
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎08-12-2018
View All

Re: Why is the JSON index field extraction failing...

by in Splunk Search
‎08-13-2018 10:29 AM
‎08-13-2018 10:29 AM
We fixed this by explicitly setting [json] KV_MODE = json It appears when unset and implicitly using KV mode, this 10k limit is hit. ... View more

Re: Why is the JSON index field extraction failing...

by in Splunk Search
‎08-13-2018 10:26 AM
‎08-13-2018 10:26 AM
The events do appear and are complete. We identified the issue - I'll add an answer for our fix ... View more

Why is the JSON index field extraction failing wit...

by in Splunk Search
‎08-12-2018 08:07 PM
‎08-12-2018 08:07 PM
I'm using indexed field extraction to ingest JSON data over the HTTP Event Collector. It works great. Except, once the event is > 10k bytes, the fields within the JSON are not indexed automatically. For example, if I submit a 15k event then search for it via host , I am able to find it. However, if I search for it via a field within the JSON, it does not come up. Is it possible to configure this setting? I haven't seen anything in the documentation yet. I'm still new to this particular functionality Thanks ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM