topic Re: Single Value fields Ingested as Multi Value in Getting Data In

Single Value fields Ingested as Multi Value

fdarrigo — Sat, 18 Aug 2018 15:06:27 GMT

I never ran into this problem before, but I hope someone has..

I have a python script which calls a REST API and passes the JSON to Splunk via the HEC.
The fields are single-valued, however, Splunk converts them to multi-value.

Does anyone know why this is happening and how to fix it?

Re: Single Value fields Ingested as Multi Value

jkat54 — Tue, 29 Sep 2020 20:56:20 GMT

Do you have multiple extraction methods defined?

Such as using indexed_extractions and kv_mode?

Re: Single Value fields Ingested as Multi Value

fdarrigo — Sat, 18 Aug 2018 16:25:42 GMT

No I don't

Re: Single Value fields Ingested as Multi Value

jkat54 — Sat, 18 Aug 2018 16:50:40 GMT

Can you provide a data sample and the sourcetype you’re using?

Re: Single Value fields Ingested as Multi Value

woodcock — Mon, 20 Aug 2018 19:46:09 GMT

Set KV_MODE to NONE and it will go away. Actually a value of AUTO might be better but the real problem is that right now it is set to JSON which is wrong because then you are parsing the JSON twice. This is definitely the problem.