topic Re: Double value in the field in Splunk Enterprise

Why am I getting duplicate values?

venkateshparank — Sun, 04 Sep 2022 22:12:48 GMT

We are ingesting AWS data through HF and I am seeing duplicate values for each field as shown in screenshot.

Few of the fields shows correct single value but most of the fields have double values.

I have added below settings in props.conf but no luck.

KV_MODE = none
AUTO_KV_JSON = false
INDEXED_EXTRACTIONS = json

venkateshparank_1-1598509908821.png

Re: Double value in the field

FritzWittwer — Thu, 03 Sep 2020 15:31:56 GMT

INDEXED_EXTRACTIONS = json

Is applied during indexing, in addition to the _raw _time _indextime, host, source and sourcetype field, all fields form the json data in the _raw field is also indexed.

There is probably a KV_MODE=auto or json active during search time, so in addition to the indexed fields, the same fields are parsed from the _raw event.

Re: Double value in the field

SplunkDevendraB — Sat, 03 Sep 2022 19:03:43 GMT

Did you find a solution for this? @venkateshparank