jira and jirasoap both the the _raw field in their result rows, so that if you run the 'events' version of the command, you have something to look at in the events
however, when _raw is set and you collect results in a summary index, the summary index ignores the existing fields, and re-parses _raw instead.
if we want to set _raw, we need to make is parseable - which is actually a little annoying for things like multivalue fields. it would be nice if intersplunk.outputResults would return directly instead of writing to file. maybe there's some way to make python do this that i'm missing.
in an case, this bug is to remove the _raw field entirely, and we'll open a separate issue to add a working _raw field.
jira and jirasoap both the the _raw field in their result rows, so that if you run the 'events' version of the command, you have something to look at in the events
however, when _raw is set and you collect results in a summary index, the summary index ignores the existing fields, and re-parses _raw instead.
if we want to set _raw, we need to make is parseable - which is actually a little annoying for things like multivalue fields. it would be nice if intersplunk.outputResults would return directly instead of writing to file. maybe there's some way to make python do this that i'm missing.
in an case, this bug is to remove the _raw field entirely, and we'll open a separate issue to add a working _raw field.