As shown in the screenshot below, sometimes our data has one entry for the geo
field and sometimes it has multiple entries for this same field. When our C# Web App issues a query to Splunk and gets results back, we use the Newtonsoft.Json library to help deserialize the JSON result into a C# object.
However, the issue is that when there is only one geo
, Splunk returns a String
object; yet when there are multiple geo
values, then Splunk returns a List<String>
. Since C# & its Newtonsoft.Json library are strongly typed, I would have to create two C# objects: one that handles geo
as a String
and another that handles geo
as a List<String>
.
Thus, my question is: Is there a way to force Splunk to always return List<String>
for the geo
field, even if the length of the list is only one?
Unfortunately, what I wanted to do above in Splunk is not possible.