topic Re: scripted input duplicate value in Getting Data In

Wha is the scripted input duplicate value?

anilkapoor123 — Fri, 07 Jul 2023 16:40:57 GMT

all fields duplicated which are coming in scripted input output. like below

Re: scripted input duplicate value

richgalloway — Tue, 04 Jul 2023 17:20:01 GMT

Please share the props.conf stanza for that sourcetype.

How is the timestamp different from _time?

Re: scripted input duplicate value

anilkapoor123 — Tue, 04 Jul 2023 22:07:11 GMT

props.conf

[json_scripted_input]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
category=Structured
description=Your own JSON definition for networker_alerts.py script
disabled=false
pulldown_type=true
TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z
TIMESTAMP_FIELDS=timestamp

timestamp is present in scripted input output

Re: scripted input duplicate value

richgalloway — Tue, 04 Jul 2023 23:49:38 GMT

Nothing wrong with those settings, although it's recommended to use SHOULD_LINEMERGE=false with LINE_BREAKER. Do the indexer/HF and search head use the same props? If the SH has KV_MODE=json then fields will be duplicated.

Re: scripted input duplicate value

isoutamo — Wed, 05 Jul 2023 06:56:28 GMT

This is continuation for this thread https://community.splunk.com/t5/Getting-Data-In/extracting-data-using-script-getting-none-in-timestamp-field/m-p/649230

Re: scripted input duplicate value

anilkapoor123 — Wed, 05 Jul 2023 07:07:33 GMT

should_line_merge=false does not make any difference in output.

i am not using kv_mode=json in other places . still i am getting duplicate field values.