Solved

Chronicle parser limits

Hello,

I tried to create an extension parser to my KUBERNETS_NODE parser by using map data fields.

I created 10 fields, and I can't add more.

Is there such a limitation to Chronicle?, If I create the extension using code snippets instead, will it work?

Thanks

Best answer by mikewilusz

I believe you are correct that the mapping UI only allows for up to 10 fields. This limit does not exist with code snippets.

-mike

+10

I believe you are correct that the mapping UI only allows for up to 10 fields. This limit does not exist with code snippets.

-mike

Sign up