topic Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data? in Getting Data In

Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

satishsdange — Mon, 13 Apr 2015 14:23:01 GMT

I have ingested JSON data & Splunk has extracted important fields automatically, but I see some mismatch between Key-Value & Count. There are many such fields with mismatch in count.

As per my screenshot for a single event, "Count" should be 1 instead of 2. Could someone advise me how to fix this problem.
(i don't see any problem with host, source, sourcetype)
props.conf

[json]
KV_MODE = json
INDEXED_EXTRACTIONS = JSON
TRUNCATE = 0
TIME_PREFIX = startTime":
MAX_TIMESTAMP_LOOKAHEAD = 16
SHOULD_LINEMERGE = False
NO_BINARY_CHECK = 0

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

somesoni2 — Mon, 13 Apr 2015 15:20:58 GMT

Can you post some sample entries?

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

satishsdange — Mon, 13 Apr 2015 15:32:22 GMT

Unfortunately, I can't share that data. Would you like to see any config?

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

somesoni2 — Mon, 13 Apr 2015 15:48:22 GMT

If you can mask all the sensitive data, that should do. I'm interested in seeing the format of jSON with the mentioned field. On cursory look, the configuration looks correct. One question though, is this a custom sourcetype? and if yes, could you try renaming it to something else?

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

martin_mueller — Mon, 13 Apr 2015 15:50:49 GMT

I'd say your event contains two Call_Drop values.

If not, you could post anonymized events.

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

satishsdange — Mon, 13 Apr 2015 16:55:28 GMT

Here is an event. Important fields have been extracted by Splunk. e.g corCallHeader.firstCellId=1.
Then I have used Alias to change it to Cell_ID.

{"corCallHeader":{"traceId":123456789123456,"startTime":1395736409790,"stopTime":1395736414180,"callDuration":4390,"rnti":0,"imsi":48,"tmsi":962442424,"

P.S - deleting original log

Re: Why am I seeing a mismatch between Key-Value and Count after ingesting JSON data?

martin_mueller — Mon, 13 Apr 2015 17:28:20 GMT

Set KV_MODE = none and your issue should go away.