All Apps and Add-ons

Disabling indexed fields for CIsco DNA

_joe
Contributor

Hello all,


Just wondering if anyone else is removed index time extractions for the Cisco DNA Center Add-on (6668). I don't like that it needlessly indexes fields then resolved the duplicate-field issue by disabling KV_MODE.

I was thinking of adding something like this to the app props.conf but I am still looking better options.

 

 

INDEXED_EXTRACTIONS = 
KV_MODE=JSON
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n\[\]\,]+\s*)([\{])
Labels (1)
0 Karma

AlonsoHM
Loves-to-Learn Lots

Hello

 

How did you manage to eliminate duplicate fields?

 

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...