topic Re: When adding &quot;KV_MODE=none&quot; to props.conf, how come unwanted field extractions are not being stopped? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414135#M73245 <P>Yes. I restarted the Splunk service on the forwarder, and stopped/started Splunk on the indexer.</P> Mon, 04 Mar 2019 18:31:29 GMT oversight 2019-03-04T18:31:29Z When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414133#M73243 <P>I am looking for assistance with unwanted fields extracted automatically.</P> <P>I am using a custom sourcetype that I added with a field extraction based on regex. This regex extracts four fields: "thread_name", "log_level", "event_category", and "messages". This works correctly, except for when I click the "xx more fields" link under Interesting Fields in the sidebar of search. That is where I see the unwanted fields are listed, and when I examine an event with one of those fields, I can see the field/value pairs are listed under the Event. The four fields specified in my regex are extracted correctly; I just want to suppress the extraction of the "fields" from within the SQL queries.</P> <P>Following the advice from another post, I added KV_MODE=none to props.conf on the forwarder and reindexed the data, but the issue still occurred. I then added KV_MODE=none to props.conf on the indexer, and reindexed the data, but I am still seeing key/value pairs extracted from the SQL queries.</P> <P>Can you please advise me of any other recommendations to stop this from happening?</P> Tue, 29 Sep 2020 23:29:16 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414133#M73243 oversight 2020-09-29T23:29:16Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414134#M73244 <P>Did you restart the Splunk service after making those props changes?</P> Mon, 04 Mar 2019 18:26:53 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414134#M73244 skoelpin 2019-03-04T18:26:53Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414135#M73245 <P>Yes. I restarted the Splunk service on the forwarder, and stopped/started Splunk on the indexer.</P> Mon, 04 Mar 2019 18:31:29 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414135#M73245 oversight 2019-03-04T18:31:29Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414136#M73246 <P>The <CODE>KV_MODE=none</CODE> is the search time field extraction setting and should be set on the Search Head. No data re-indexing is required.</P> Mon, 04 Mar 2019 18:42:09 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414136#M73246 somesoni2 2019-03-04T18:42:09Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414137#M73247 <P>You need to deploy this to your Search Head tier, not the Indexers.</P> Mon, 04 Mar 2019 18:45:47 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414137#M73247 woodcock 2019-03-04T18:45:47Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414138#M73248 <P>The deployment consists of a single server running Splunk Enterprise, and forwarders installed on various hosts. Can you confirm if need to deploy this at $SPLUNK_HOME/etc/apps/search/local/props.conf on the server ?</P> Mon, 04 Mar 2019 19:11:51 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414138#M73248 oversight 2019-03-04T19:11:51Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414139#M73249 <P>I deployed it to $SPLUNK_HOME/etc/apps/search/local/props.conf and it worked. Thank you!</P> Mon, 04 Mar 2019 20:24:38 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414139#M73249 oversight 2019-03-04T20:24:38Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414140#M73250 <P>I verified no data re-indexing is required. Thank you!</P> Mon, 04 Mar 2019 20:25:02 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414140#M73250 oversight 2019-03-04T20:25:02Z Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped? https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414141#M73251 <P>Thank you!</P> Mon, 04 Mar 2019 20:25:57 GMT https://community.splunk.com/t5/Getting-Data-In/When-adding-quot-KV-MODE-none-quot-to-props-conf-how-come/m-p/414141#M73251 oversight 2019-03-04T20:25:57Z