Dublicated json fields on searchHead

SPavel — Wed, 21 Oct 2020 16:50:44 GMT

Hello everyone!

I have clustered infrastructure (simplified)

2 SH (cluster) + 2 Indexer (cluster) + Heavy Forwarder (name HF)

On HF i run some script which returns me json file, and i forward it from HF to Indexers (HF -> IndexCluser)

After that, i have to make some searches on SH with that data

When i make search request, i have correctly parsed json, look perfect. BUT when i use `table` or just expand results each json field are dublicated.

I have custom sourcetype defined on the Heavy Forwarder (although i tried some variations):

[just_json] INDEXED_EXTRACTIONS = json KV_MODE = none AUTO_KV_JSON = false NO_BINARY_CHECK = true pulldown_type = true category = Application

I assume that it multiplies on two because of:

json parsed during indexing (or sendind from Heavy?)

json parsed additionally on searchHead during search performed

I have read some similar questions (not sure about cluster case) but haven't succeed.

Still cant figure out.

Thanks in advance.

topic Dublicated json fields on searchHead in Getting Data In