https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442692#M95441 <P>This looks like <CODE>INDEXED_EXTRACTIONS = JSON</CODE> on UF side and <CODE>KV_MODE = auto</CODE> (This is default) or <CODE>KV_MODE = json</CODE> on search head is present and due to that it is extracting JSON event twice.</P> <P>You need to set <CODE>KV_MODE = none</CODE> on search head for your sourcetype so search head will not extract this JSON event again.</P> <P>On SH props.conf</P> <PRE><CODE>[yoursourcetype] KV_MODE = none </CODE></PRE> Mon, 18 Mar 2019 13:26:28 GMT harsmarvania57 2019-03-18T13:26:28Z https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442690#M95439 <P>The field value is duplicated in independent Stream forwarder. Is there a workaround?</P> <UL> <LI>Version Splunk 6.5.5 and independent Stream forwarder 7.1.1</LI> </UL> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6706i20F9A090E1E895D5/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 18 Mar 2019 02:18:44 GMT https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442690#M95439 luckinfo 2019-03-18T02:18:44Z https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442691#M95440 <P>Is this forwarded with <CODE>useAck = true</CODE> set on the forwarders outputs.conf?</P> Mon, 18 Mar 2019 12:12:14 GMT https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442691#M95440 nickhills 2019-03-18T12:12:14Z https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442692#M95441 <P>This looks like <CODE>INDEXED_EXTRACTIONS = JSON</CODE> on UF side and <CODE>KV_MODE = auto</CODE> (This is default) or <CODE>KV_MODE = json</CODE> on search head is present and due to that it is extracting JSON event twice.</P> <P>You need to set <CODE>KV_MODE = none</CODE> on search head for your sourcetype so search head will not extract this JSON event again.</P> <P>On SH props.conf</P> <PRE><CODE>[yoursourcetype] KV_MODE = none </CODE></PRE> Mon, 18 Mar 2019 13:26:28 GMT https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442692#M95441 harsmarvania57 2019-03-18T13:26:28Z https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442693#M95442 <P>Scratch my comment - i misread 'field duplicated' as 'event duplicated'</P> Mon, 18 Mar 2019 13:31:47 GMT https://community.splunk.com/t5/Getting-Data-In/independent-stream-forwarder-field-value-duplication-problem/m-p/442693#M95442 nickhills 2019-03-18T13:31:47Z