字段text类型以大括号开头 Java里获取不到

Posted 2023-04-08

参考技术A TINYTEXT和CHAR。
CHAR，保存固定长度的字符串（可包含字母，数字以及特殊字符）。在括号中指定字符串的长度。最多255个字符。TINYTEXT，存放最大长度为255个字符的字符串。TEXT，存放最大长度为65535个字符的字符串。

text 获取索引/源类型的所有字段

| rest /services/data/indexes 
| rename title as index 
| fields index 
| dedup index 
| where NOT match(index, "^(_.+|notable|notable_summary|risk)$") 
| map search="| metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\" | rename lastTime as et | where NOT match(sourcetype, \"(-too[-_]small$|-\d+$)\") | table index, sourcetype, et" maxsearches=1000 
| eval lt=et+(60*5) 
| head 10
| map maxsearches=1000 search="| search index=$index$ sourcetype=$sourcetype$ earliest=$et$ latest=$lt$ | fields - date_hour, date_mday, date_minute, date_month, date_second, date_wday, date_year, date_zone, eventtype, host, linecount, punct, splunk_server, splunk_server_group, tag, tag::*, timeendpos, timestartpos | fieldsummary maxvals=0 | fields field | eval index=\"$index$\", sourcetype=\"$sourcetype$\" | stats values(field) as fields by index, sourcetype | fields - field"