topic Re: Why is a value appearing twice in a table but only occurs once in the event data? in Splunk Search

Why is a value appearing twice in a table but only occurs once in the event data?

rob_gibson — Fri, 21 Oct 2016 14:12:44 GMT

I'm running a very simple search to draw a table. One of the values returned is appearing twice in the table, but only occurs once in the event data. Is this a bug?

Here is the search string;

 index=* host=serverhostname EventCode=33205 | table ComputerName, statement

The result in the table is the value for 'statement' appears twice. I get two events returned, with two lines each but only the 'statement' value is doubled. All other fields are blank on the second line.

Here is the event data that is being queried;

10/17/2016 12:20:25 PM
LogName=Application
SourceName=MSSQL$OTPMSSQL
EventCode=33205
EventType=0
Type=Information
ComputerName=HOSTNAME.FQDN
TaskCategory=None
OpCode=None
RecordNumber=904492
Keywords=Audit Success, Classic
Message=Audit event: event_time:2016-10-17 16:20:24.1512330
sequence_number:1
action_id:AL  
succeeded:true
permission_bitmask:0
is_column_permission:false
session_id:136
server_principal_id:276
database_principal_id:1
target_server_principal_id:0
target_database_principal_id:0
object_id:8
class_type:DB
session_server_principal_name:DOMAIN\USERID
server_principal_name:DOMAIN\USERID
server_principal_sid:010500000000000515000000093a2a2426761e2f43170a326b1e0000
database_principal_name:dbo
target_server_principal_name:
target_server_principal_sid:
target_database_principal_name:
server_instance_name:SERVERNAME\OTPMSSQL
database_name:DBA
schema_name:
object_name:DBA
statement:ALTER DATABASE [DBA] MODIFY FILE ( NAME = N'DBA_log', FILEGROWTH = 1048576KB )
additional_information:
.
Collapse

Re: Why is a value appearing twice in a table but only occurs once in the event data?

somesoni2 — Fri, 21 Oct 2016 15:56:37 GMT

Seems like those field have been extracted twice by Splunk making it a multivalued field. Check your props.conf for the sourcetype to see if there are two configuration setup for field extraction.

Re: Why is a value appearing twice in a table but only occurs once in the event data?

rob_gibson — Fri, 21 Oct 2016 16:45:44 GMT

Thank you! That put me on the right track. I used nomv to eliminate the multivalue.

index=* ComputerName="serverhostname" EventCode=33205 | nomv statement | table ComputerName, statement

Re: Why is a value appearing twice in a table but only occurs once in the event data?

somesoni2 — Fri, 21 Oct 2016 17:52:55 GMT

Another option would be this

index=* ComputerName="serverhostname" EventCode=33205  | table ComputerName, statement | eval statement=mvindex(statement,0)

Re: Why is a value appearing twice in a table but only occurs once in the event data?

aaraneta_splunk — Mon, 24 Oct 2016 02:13:31 GMT

Hi @rob.gibson - Did this search that you posted help to resolve your issue?

Re: Why is a value appearing twice in a table but only occurs once in the event data?

rob_gibson — Mon, 24 Oct 2016 19:29:56 GMT

Yes, specifically adding "| nomv statement |" corrected the issue.

Re: Why is a value appearing twice in a table but only occurs once in the event data?

jbillings — Wed, 30 Sep 2020 02:47:34 GMT

Not sure if your data is coming in JSON or not, but I've seen the same issue with KV extractions with JSON. I had to add a local props.conf with the below stanza to the SH to resolve. This disabled the KV_MODE config on the SH.

[source::foo]
KV_MODE = NONE
You can disable the KV_MODE on either the SH or the forwarder. Disabling on the forwarder will use search-time extractions, disabling on SH will use index-time extractions.
Again, not sure if your data is JSON or not, but hope this helps.

Re: Why is a value appearing twice in a table but only occurs once in the event data?

tomaskucerak — Fri, 13 Nov 2020 13:04:24 GMT

This answer helped me more then the answer marked as solution.

Re: Why is a value appearing twice in a table but only occurs once in the event data?

aa70627 — Wed, 10 Feb 2021 19:55:13 GMT

i couldn't agree more

Re: Why is a value appearing twice in a table but only occurs once in the event data?

mystic_warrior — Tue, 22 Apr 2025 21:44:33 GMT

This worked for me! The other 2 above did not for some reason. Thanks