https://community.splunk.com/t5/Splunk-Search/JSON/m-p/527508#M148906 <P>I have a JSON file with .json extension which has a complete one line unstructured json. any events gets added to the json array with the same one line json every 5 minutes.</P> <P>Gone through multiple responses related to duplicate events for JSON, this is what my configurations looks both on search head and indexer props.conf , but still I can see duplicate events when searching on search head</P> <LI-CODE lang="markup">[dell:boomi:atom] LINE_BREAKER=(\},) MUST_BREAK_AFTER=([\},]) SHOULD_LINEMERGE=false SEDCMD-remove_header=s/({"jmx":\[)//g SEDCMD-remove_footer=s/(}]})//g INDEXED_EXTRACTIONS = JSON KV_MODE = none AUTO_KV_JSON = false TIME_PREFIX={"(?=\d+-\d+-\d+T) TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=24 TRUNCATE = 0</LI-CODE> Thu, 05 Nov 2020 00:59:26 GMT divman 2020-11-05T00:59:26Z https://community.splunk.com/t5/Splunk-Search/JSON/m-p/527508#M148906 <P>I have a JSON file with .json extension which has a complete one line unstructured json. any events gets added to the json array with the same one line json every 5 minutes.</P> <P>Gone through multiple responses related to duplicate events for JSON, this is what my configurations looks both on search head and indexer props.conf , but still I can see duplicate events when searching on search head</P> <LI-CODE lang="markup">[dell:boomi:atom] LINE_BREAKER=(\},) MUST_BREAK_AFTER=([\},]) SHOULD_LINEMERGE=false SEDCMD-remove_header=s/({"jmx":\[)//g SEDCMD-remove_footer=s/(}]})//g INDEXED_EXTRACTIONS = JSON KV_MODE = none AUTO_KV_JSON = false TIME_PREFIX={"(?=\d+-\d+-\d+T) TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N MAX_TIMESTAMP_LOOKAHEAD=24 TRUNCATE = 0</LI-CODE> Thu, 05 Nov 2020 00:59:26 GMT https://community.splunk.com/t5/Splunk-Search/JSON/m-p/527508#M148906 divman 2020-11-05T00:59:26Z