Hi Fellow Splunkers, How can I add multi-value field (array) directly to the index through `/var/spool/splunk`. I tried multiple approaches: 1. Dict ==##~~##~~ 1E8N3D4E6V5E7N2T9 ~~##~~##== { "array_field":["1", "2"], "count": "2", ... } 2. Classic ==##~~##~~ 1E8N3D4E6V5E7N2T9 ~~##~~##== ... , array_field=["1", "2"], count="2", ... I achieved best results with Dict approach. Added field correctly has multiple values, however ... to key ("array_field") splunk adds {}, resulting in incorrect key ("array_field{}") Do you have any suggestions?
... View more