https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470157#M99652 <P>@Nadhiyaa, are you using <CODE>stats</CODE> or <CODE>dedup</CODE> ? You shouldnt have duplicated if that's the case. Could you please post your query. </P> Mon, 02 Sep 2019 06:35:14 GMT DavidHourani 2019-09-02T06:35:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470156#M99651 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7618i21CCB5D6AE39488C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Below is sample data . How to remove the duplicate values </P> Mon, 02 Sep 2019 05:52:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470156#M99651 Nadhiyaa 2019-09-02T05:52:07Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470157#M99652 <P>@Nadhiyaa, are you using <CODE>stats</CODE> or <CODE>dedup</CODE> ? You shouldnt have duplicated if that's the case. Could you please post your query. </P> Mon, 02 Sep 2019 06:35:14 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470157#M99652 DavidHourani 2019-09-02T06:35:14Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470158#M99653 <P>Hi,</P> <P>It looks like you are using <CODE>INDEXED_EXTRACTIONS = json</CODE> and <CODE>KV_MODE = json</CODE>. If you are using <CODE>INDEXED_EXTRACTIONS = json</CODE> while ingesting the data then set <CODE>KV_MODE = none</CODE> on Search Head and it will not display duplicate value.</P> Mon, 02 Sep 2019 08:02:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470158#M99653 harsmarvania57 2019-09-02T08:02:22Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470159#M99654 <P>Below configuration will help to remove duplicates in JSON events.</P> <P><CODE>props.conf</CODE> in <STRONG>Indexer</STRONG></P> <PRE><CODE>[&lt;source_type&gt;] INDEXED_EXTRACTIONS = json category = Structured </CODE></PRE> <P><CODE>props.conf</CODE> in <STRONG>Search head</STRONG></P> <PRE><CODE>[&lt;source_type&gt;] AUTO_KV_JSON = false KV_MODE = none </CODE></PRE> <P>This answer is based on input from @harsmarvania57. Thanks.</P> Tue, 03 Sep 2019 01:01:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470159#M99654 jawaharas 2019-09-03T01:01:29Z https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470160#M99655 <P>@Nadhiyaa <BR /> Kindly accept the answer if it helped you, so others can refer it.</P> Thu, 05 Sep 2019 01:47:29 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-remove-the-duplicate-values-from-json-events/m-p/470160#M99655 jawaharas 2019-09-05T01:47:29Z