topic Each extracted field multivalue with duplicate values for JSON events in Splunk Search

Each extracted field multivalue with duplicate values for JSON events

amoldesai — Tue, 29 Sep 2020 09:17:16 GMT

Hi,

I am using splunk version 6.3.3 for forwarder and indexers in a clustered environment. Issue is when the search query is executed,it returns multivalue fields with duplicate values.

I have seen few similar posts in the forum ,but could not resolve the issue after referring it. It appears splunk does index time extraction as well as search time extractions of fields here.

Here is the configuration of props.conf on forwarder side :

[event-cache-v2]
category = Structured
KV_MODE = none
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timeStamp
disabled = false
pulldown_type = true
AUTO_KV_JSON = false

On indexer,we tried with multiple combination of props.conf. First having the above config in props.conf and then removing it and trying with just KV_MODE=none and AUTO_KV_JSON = false in props.conf file

But it did not help.

Can you please help us in fixing this issue.

Thanks.

Re: Each extracted field multivalue with duplicate values for JSON events

woodcock — Sat, 02 Apr 2016 21:06:51 GMT

The KV_MODE=none and AUTO_KV_JSON = false settings in your props.conf file must be on your Search Head, too.

Re: Each extracted field multivalue with duplicate values for JSON events

amoldesai — Tue, 29 Sep 2020 09:18:49 GMT

Thanks .Yes we added KV_MODE=none. Following is the working configuration that we have now :

Search Head:
system/local
[sourcetype-v2]
KV_MODE=none

Indexer:
system/local
[sourcetype-v2]
KV_MODE=none

Forwarder:
placed in an app
[sourcetype-v2]
INDEXED_EXTRACTIONS = JSON
NO_BINARY_CHECK = true

Thanks.

Re: Each extracted field multivalue with duplicate values for JSON events

woodcock — Tue, 05 Apr 2016 19:18:19 GMT

Perfect, did you restart your Search Head? What you have should work.