Splunk Search does not return all event data on a field

1
votes

I'm facing a very strange issue in my Splunk search. I have a data input coming from a REST API that returns a multi-level (nested) JSON response:

REST API Response Sample

The entity node has several nodes, each node represents one access point. Each access point contains a field called ipAddress. This API is being called every 5 min and response stored in Splunk. When I do a search to get the list of IP Addresses from one event I don't get all of them. For some reason, is like Splunk is reading only the first seven nodes inside entity, because when I do:

   source="rest://AccessPointDetailsAPI" | head 1

Splunk shows only the following values on the field (7 values although there are around 27):

Splunk fields data

I'm using demo license if that matters. Why I cannot see all values ? If I change my search to look for a specific iPAddress on the response but not on the list it won't return records.

Thanks and regards,

1
splunk

1 Answers

1
votes

I think I understand the problem now. So the event is a big json and Splunk is not properly parsing all fields on the big json.

We need to tell splunk to parse the specific field we need with spath and specifying the field:

yoursearch | spath output=myIpAddress path=queryResponse.entity{}.accessPointDetailsDTO.ipAddress | table myIpAddress

http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Spath

But I think also is important to analyze if maybe the data input needs to be divided in multiple events rather than a single huge event.