topic Field value duplication in Knowledge Management

Field value duplication

Haleb — Mon, 08 Jul 2024 08:36:58 GMT

Hi, I created custom input using HEC in distributed environment. When searching, I see that the values for the fields are duplicated, that is, for one event I have two values.

Any ideas why this might be happening?

Re: Field value duplication

PickleRick — Mon, 08 Jul 2024 09:28:25 GMT

It's hard to be sure not knowing your config and data but the typical case is that you're using both indexed fields as well as search-time json extractions.

Re: Field value duplication

gcusello — Mon, 08 Jul 2024 10:19:57 GMT

Hi @Haleb ,

as @PickleRick said, it's hard to help you without any information about your architecture.

Anyway, how are you sending logs?

are you using one or two receivers?

how many inputs did you enabled?

are you using a Load Balancer?

Ciao.

Giuseppe