topic Re: Values repeated in each field in Getting Data In

Values repeated in each field

AnujaJ — Wed, 30 Sep 2020 00:06:29 GMT

I am getting repeated values in Splunk fields. This can be seen only in Table view. For list view/raw there is no repetition seen. However, my search queries treat all these fields as multi-valued fields. I do not want the repeated values in the single valued field.

Values in Splunk

Props.conf
[kpi_json]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=json
KV_MODE=none
SHOULD_LINEMERGE=true
category=Structured
description=JavaScript Object Notation format. For more information, visit http://json.org/
disabled=false
pulldown_type=true
LINE_BREAKER=([\r\n]+)
TZ=Europe/Berlin
TIMESTAMP_FIELDS=@timestamp

Re: Values repeated in each field

solarboyz1 — Wed, 17 Apr 2019 13:56:21 GMT

What is the search used to generate the table

Re: Values repeated in each field

AnujaJ — Wed, 17 Apr 2019 13:59:17 GMT

index=kpi sourcetype=kpi_json

Re: Values repeated in each field

solarboyz1 — Wed, 17 Apr 2019 14:10:45 GMT

It sounds like you want to dedup a multi-value field:

| eval a=dedup(a), b=dedup(b)

Re: Values repeated in each field

AnujaJ — Wed, 17 Apr 2019 14:17:04 GMT

This is not a multivalued field. This is a single valued field. All fields except the date field are affected. I want all the fields to appear as single valued field. The json data has getting wrongly doubled values.

Re: Values repeated in each field

woodcock — Thu, 18 Apr 2019 02:42:53 GMT

Try these settings in props.conf on your Search Heads:

[YourSourcetypeHere]
KV_MODE = none
AUTO_KV_JSON = false

Re: Values repeated in each field

AnujaJ — Thu, 18 Apr 2019 07:49:39 GMT

I have these settings on props.conf on UF. Is that the problem that I need to put these settings on SH?

Re: Values repeated in each field

woodcock — Thu, 18 Apr 2019 12:33:29 GMT

Yes, that is most definitely the problem.

Re: Values repeated in each field

AnujaJ — Fri, 17 May 2019 13:28:03 GMT

I removed Indexed extractions from the prop.conf on UF. And that resolved my issue.