Assuming i have interpreted your JSON right,, spath is interpreting correctly:
I tested with this:
| makeresults |eval samplejson="{
\"dataUpdatedTime\": \"2017-12-28T12:07:00+02:00\",
\"links\": [{
\"id\": 27,
\"linkMeasurements\": [{
\"fluencyClass\": 5,
\"minute\": 329,
\"averageSpeed\": 75.851,
\"medianTravelTime\": 158,
\"measuredTime\": \"2017-12-27T05:29:00+02:00\"
}, {
\"fluencyClass\": 5,
\"minute\": 331,
\"averageSpeed\": 75.851,
\"medianTravelTime\": 158,
\"measuredTime\": \"2017-12-27T05:31:00+02:00\"
}, {
\"fluencyClass\": 5,
\"minute\": 354,
\"averageSpeed\": 83.807,
\"medianTravelTime\": 143,
\"measuredTime\": \"2017-12-27T05:54:00+02:00\"
}],
\"measuredTime\": \"2017-12-27T22:38:00+02:00\"
}, {
\"id\": 30,
\"linkMeasurements\": [{
\"fluencyClass\": 5,
\"minute\": 0,
\"averageSpeed\": 43.548,
\"medianTravelTime\": 124,
\"measuredTime\": \"2017-12-27T00:00:00+02:00\"
}]
}]
}"|spath input=samplejson|table *
I wonder if your issue is truncation - very large Json events which exceed 10,000 bytes can often cause complications.
Run this:
index=_internal sourcetype=splunkd LineBreakingProcessor - Truncating line because limit of 10000 has been exceeded
Do you see this for your json sourcetype?
... View more