https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407255#M72212 <P>Before you ask, I have found at least 10 questions similar to this as well as two identical questions, both of which are unresolved.</P> <P>I have one sourcetype which extracts fields from a JSON properly. Awesome, no problem. I created a second sourcetype with the <STRONG>same</STRONG> settings and <EM>all fields are extracted twice during a search</EM>. The only difference in the data is the first sourcetype has the JSON on a single line. The second sourcetype has the JSON indented on multiple lines. This results in a multi-value field (not a duplicate event.)</P> <P>I'm running v7.0.1 with forwarders. I am a loss of what to even check next. Suggestions??? </P> <H2>Thanks!</H2> <H3>FIRST (ORIGINAL-WORKS FINE)</H3> <PRE><CODE>SHOULD_LINEMERGE = true INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true CHARSET=UTF-8 KV_MODE = none AUTO_KV_JSON = false category=Structured description=JavaScript Object... disabled=false pulldown_type=true TIMESTAMP_FIELDS = timestamp TIME_FORMAT=%Y-%m-%dT%H%M%S%Z TRUNCATE=0 </CODE></PRE> <H3>SECOND (EXTRACTS DUPLICATES)</H3> <PRE><CODE>INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true CHARSET=UTF-8 KV_MODE = none AUTO_KV_JSON = false category=Structured description=JavaScript Object... disabled=false pulldown_type=true TIMESTAMP_FIELDS = timestamp TIME_FORMAT=%Y-%m-%dT%H%M%S%Z TRUNCATE=0 </CODE></PRE> <P>along with all combinations of </P> <PRE><CODE>BREAK_ONLY_BEFORE_DATE = [true | false] SHOULD_LINEMERGE = [true | false] </CODE></PRE> Tue, 22 May 2018 21:14:20 GMT mgallacher 2018-05-22T21:14:20Z https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407255#M72212 <P>Before you ask, I have found at least 10 questions similar to this as well as two identical questions, both of which are unresolved.</P> <P>I have one sourcetype which extracts fields from a JSON properly. Awesome, no problem. I created a second sourcetype with the <STRONG>same</STRONG> settings and <EM>all fields are extracted twice during a search</EM>. The only difference in the data is the first sourcetype has the JSON on a single line. The second sourcetype has the JSON indented on multiple lines. This results in a multi-value field (not a duplicate event.)</P> <P>I'm running v7.0.1 with forwarders. I am a loss of what to even check next. Suggestions??? </P> <H2>Thanks!</H2> <H3>FIRST (ORIGINAL-WORKS FINE)</H3> <PRE><CODE>SHOULD_LINEMERGE = true INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true CHARSET=UTF-8 KV_MODE = none AUTO_KV_JSON = false category=Structured description=JavaScript Object... disabled=false pulldown_type=true TIMESTAMP_FIELDS = timestamp TIME_FORMAT=%Y-%m-%dT%H%M%S%Z TRUNCATE=0 </CODE></PRE> <H3>SECOND (EXTRACTS DUPLICATES)</H3> <PRE><CODE>INDEXED_EXTRACTIONS = json NO_BINARY_CHECK = true CHARSET=UTF-8 KV_MODE = none AUTO_KV_JSON = false category=Structured description=JavaScript Object... disabled=false pulldown_type=true TIMESTAMP_FIELDS = timestamp TIME_FORMAT=%Y-%m-%dT%H%M%S%Z TRUNCATE=0 </CODE></PRE> <P>along with all combinations of </P> <PRE><CODE>BREAK_ONLY_BEFORE_DATE = [true | false] SHOULD_LINEMERGE = [true | false] </CODE></PRE> Tue, 22 May 2018 21:14:20 GMT https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407255#M72212 mgallacher 2018-05-22T21:14:20Z https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407256#M72213 <P>What’s the name of your two sourectypes ?<BR /> Where have you deployed them? SH or forwarder?</P> Wed, 28 Aug 2019 03:13:32 GMT https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407256#M72213 iparitosh 2019-08-28T03:13:32Z https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407257#M72214 <P>Having the same exact problem and I can't figure it out.</P> Tue, 22 Oct 2019 22:05:58 GMT https://community.splunk.com/t5/Getting-Data-In/Using-INDEXED-EXTRACTIONS-json-produces-duplicate-values/m-p/407257#M72214 mstrozyk 2019-10-22T22:05:58Z