topic Re: SPLUNK FIELDS ARE SHWOING 200% in Splunk Search

Why are Splunk Fields showing 200%?

HarperWCurran — Wed, 17 Aug 2022 14:18:13 GMT

Hi,

i am doing a search and noticing that i am getting 200% on the fields i troubleshooted and used this line at the beginning of my search

KV_MODE = none
AUTO_KV_JSON = false

however it instead returns with no events what so ever and i have the time on all time yet i still get nothing

please help

Re: SPLUNK FIELDS ARE SHWOING 200%

yuanliu — Wed, 17 Aug 2022 07:39:11 GMT

Those expressions are meant for props.conf, not in search language. You need to check that sourcetype in props.conf to make sure that you don't have duplicate extraction.

Re: SPLUNK FIELDS ARE SHWOING 200%

gcusello — Wed, 17 Aug 2022 07:50:15 GMT

Hi @HarperWCurran,

as @yuanliu said, these are options for props.conf, if you put them in the beginning of your search you're searching for these strings and obviously you don't find anything.

Could you share your search and a screenshot of the 200%?

Have you multivalues fields?

Ciao.

Giuseppe