Searching using a field extraction rule field fails when used AFTER json auto
Our logs are a formatted JSON string. We are attempting to search using a field extracted using a field extraction rule. The field correctly shows up when we do a simple search. However, after using `json auto` it fails to find data. Here are two example queries that represent what we are seeing. The field `dc` is the extracted rule.
1. This request fails to find any results ```_sourceCategory={source} "/samples?ownerIds=" | json auto | where !isNull(%"responsetime") | where dc = "{dc value}"```
2. The request finds results ```_sourceCategory=ta-cop-{source} "/samples?ownerIds=" | where dc = "{dc value}" | json auto | where !isNull(%"responsetime")```.
Notice how the only difference is the order of where the `where dc="g1-iad"` is located.
-
Official comment
Devon,
Thanks for bringing this to our attention this issue with the "json auto" operator where it overrides a FER extracted field value with a null value for a field that does not exist in the raw message. We are addressing this issue shortly
Best,
Raghu
Sumo Logic Inc.
Comment actions
Please sign in to leave a comment.
Comments
1 comment