Getting Data In

independent stream forwarder field value duplication problem

luckinfo
Engager

The field value is duplicated in independent Stream forwarder. Is there a workaround?

  • Version Splunk 6.5.5 and independent Stream forwarder 7.1.1

alt text

Tags (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

This looks like INDEXED_EXTRACTIONS = JSON on UF side and KV_MODE = auto (This is default) or KV_MODE = json on search head is present and due to that it is extracting JSON event twice.

You need to set KV_MODE = none on search head for your sourcetype so search head will not extract this JSON event again.

On SH props.conf

[yoursourcetype]
KV_MODE = none

nickhills
Ultra Champion

Is this forwarded with useAck = true set on the forwarders outputs.conf?

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Scratch my comment - i misread 'field duplicated' as 'event duplicated'

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...