The field value is duplicated in independent Stream forwarder. Is there a workaround?
This looks like
INDEXED_EXTRACTIONS = JSON on UF side and
KV_MODE = auto (This is default) or
KV_MODE = json on search head is present and due to that it is extracting JSON event twice.
You need to set
KV_MODE = none on search head for your sourcetype so search head will not extract this JSON event again.
On SH props.conf
[yoursourcetype] KV_MODE = none