topic Re: Why are my json data extracted twice in Knowledge Management

Why are my json data extracted twice

rolfberkenbosch — Tue, 29 Sep 2020 17:31:29 GMT

My inputs.conf is:

[monitor:///var/log/grains.log]
sourcetype = grains_log
disabled = 0
index = os

My props.conf is as follows:
[grains_log]
INDEXED_EXTRACTIONS = json
KV_MODE = none

But I keep seeing double values.

Does someone has an idea what I miss here ?

Re: Why are my json data extracted twice

somesoni2 — Tue, 09 Jan 2018 19:07:29 GMT

Where does this props.conf resides? Do you've dedicated search heads?

Re: Why are my json data extracted twice

mdsnmss — Tue, 29 Sep 2020 17:54:00 GMT

These questions should help answer yours. The INDEXED_EXTRACTIONS = json should be located where the data is being indexed. If the search head is on a different system from where the indexing is taking place then you will also need the props.conf for that sourcetype on the search head specifying KV_MODE = none. It's likely you are getting both index time and search time extractions for the JSON data.

Re: Why are my json data extracted twice

micahkemp — Sun, 04 Feb 2018 16:40:11 GMT

You may consider converting this to an answer.

Re: Why are my json data extracted twice

felipesewaybric — Sun, 04 Feb 2018 23:30:50 GMT

while you can find the solution, you can use "| dedup _raw" to remove duplicates,

Re: Why are my json data extracted twice

ddrillic — Mon, 05 Feb 2018 14:28:57 GMT

-- double values

What do you mean by that? do you see the events once and twice the count of values on the fields side bar?