Why are my json fields extracted twice? (redux)

jamescrowley — Mon, 28 Sep 2020 20:05:44 GMT

I came across http://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html which seemed to describe perfectly the issue, but I've been unable to resolve - as far as I can see, KV_MODE is already set to none.

On our collectors, we have an app with props.conf as follows:

[fundapps_logs]
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = datetime
TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l
INDEXED_EXTRACTIONS = json
TRUNCATE = 20000
KV_MODE = none

however, we see two sets of fields in results when we search (but not for the built in splunk fields). If I then do

sourcetype=fundapps_logs | extract

I then see three sets of fields in results. I'm guessing I've got a config issue somewhere.

I've tried adding the same app and props.config to the splunk search/web head (everything runs on a single machine), and restarting but it doesn't appear to have any impact.

Any suggestion?

Re: Why are my json fields extracted twice? (redux)

somesoni2 — Thu, 24 Sep 2015 20:34:55 GMT

Not sure if you still have this problem, but the answer to this problem is here

https://answers.splunk.com/answers/301893/why-are-several-json-fields-getting-extracted-more.html

Re: Why are my json fields extracted twice? (redux)

woodcock — Tue, 06 Oct 2015 16:50:07 GMT

Did you deploy this to your Indexers and after that did you restart all Splunk instances on the Indexers?

topic Re: Why are my json fields extracted twice? (redux) in Splunk Search

Why are my json fields extracted twice? (redux)

Re: Why are my json fields extracted twice? (redux)

Re: Why are my json fields extracted twice? (redux)