I have a multivalve nested json that I need to parse, auto_kv_json is enabled on my props.conf file, and it is extracting most of my key values. But for some reason, there are a few that splunk is not extracting, I can see those values if I check the raw data, but splunk won't present them to me in the results as json data.
This is how my json looks:
"some_name": {
"my.very.nested.json.output.some.more.strings.tomakeitcomplicated": {
"count": 1,
"max": 0.5,
"mean": 0.1,
"min": 0.092808133,
"mean_rate": 0.30310791967810413,
"duration_units": "seconds",
"rate_units": "calls/second"
},
I need to extract the count, so I can present it on a table.
... View more