https://community.splunk.com/t5/Getting-Data-In/JSON-options-either-limits-tuncates-events-OR-extract-twice/m-p/258190#M49602 <P>Hi Guys</P> <P>Pretty new to all this and struggling to understand all the other answers.</P> <P>I have a cronjob which is extracting CMDB data from service now in json format at 1am each day. its over writes a file. My splunk is monitoring that file. I am expecting 463 results/events. with 90ish fields per event.</P> <P>I have universal forwarder on a server with internet access which forwards straight to the indexers.</P> <P>I have tried these settings in props.conf:]</P> <PRE><CODE>KV_MODE = json AUTO_KV_JSON = false NO_BINARY_CHECK = 1 TRUNCATE = 0 </CODE></PRE> <P>BUT using this searches only give me 207 results/events.</P> <P>So I then tried</P> <PRE><CODE>INDEXED EXTRACTIONS = JSON KV_MODE = none NO_BINARY_CHECK = 1 TRUNCATE = 0 </CODE></PRE> <P>This gives me the expected 463 events, but the search is extracting the fields twice. </P> <P>How do I get all the events, with only 1 extracted <BR /> is there some sort of LIMIT I can set </P> Sun, 04 Sep 2016 09:24:02 GMT mjm295 2016-09-04T09:24:02Z https://community.splunk.com/t5/Getting-Data-In/JSON-options-either-limits-tuncates-events-OR-extract-twice/m-p/258190#M49602 <P>Hi Guys</P> <P>Pretty new to all this and struggling to understand all the other answers.</P> <P>I have a cronjob which is extracting CMDB data from service now in json format at 1am each day. its over writes a file. My splunk is monitoring that file. I am expecting 463 results/events. with 90ish fields per event.</P> <P>I have universal forwarder on a server with internet access which forwards straight to the indexers.</P> <P>I have tried these settings in props.conf:]</P> <PRE><CODE>KV_MODE = json AUTO_KV_JSON = false NO_BINARY_CHECK = 1 TRUNCATE = 0 </CODE></PRE> <P>BUT using this searches only give me 207 results/events.</P> <P>So I then tried</P> <PRE><CODE>INDEXED EXTRACTIONS = JSON KV_MODE = none NO_BINARY_CHECK = 1 TRUNCATE = 0 </CODE></PRE> <P>This gives me the expected 463 events, but the search is extracting the fields twice. </P> <P>How do I get all the events, with only 1 extracted <BR /> is there some sort of LIMIT I can set </P> Sun, 04 Sep 2016 09:24:02 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-options-either-limits-tuncates-events-OR-extract-twice/m-p/258190#M49602 mjm295 2016-09-04T09:24:02Z https://community.splunk.com/t5/Getting-Data-In/JSON-options-either-limits-tuncates-events-OR-extract-twice/m-p/258191#M49603 <P>ok did some more reading and stuck with the second option but added </P> <PRE><CODE>kvmode = none </CODE></PRE> <P>to my search head props (for this 1 source,, now I am seeing all results, but only 1 set.</P> <P>i need to understand the indexed extractions better...</P> Sun, 04 Sep 2016 22:12:39 GMT https://community.splunk.com/t5/Getting-Data-In/JSON-options-either-limits-tuncates-events-OR-extract-twice/m-p/258191#M49603 mjm295 2016-09-04T22:12:39Z