I'm currently kind of confused using splunk enterprise. I am using splunk enterprise 7.2.8 version.
I need to use table command like below, but the command outputs with same 2 values as you can see also as below.
host="myhost" index="myindex" sourcetype="mytype" source="mysource" | table field1, field2
[results - table]
For your information, our org configured splunk system like below.
splunk universal forwarder -> splunk heavy forwarder -> splunk indexer <- search header
And above information is sent from server with splunk universal forwarder.
Any idea to solve this problem??
This seems to imply that field1 and field2 are either duplicated in the original event, or that the extraction process in duplicating them. You probably need to look at the props and transform configurations
Ok. Thanks for reply.
First of all, it is not just those 2 fields that comes out duplicated. All fields came out like that.
And my splunk universal forwarder's path is like below.
And props.conf, the file is written like below.
Yes, those fields are all JSON format data.
I run python script in my server, and that python script results in one JSON file.
And SplunkUniversal forwarder monitors where the JSON file come out.
And I uploaded props.conf stanza on above reply just now. Please check.
Hi @splunkkid , I thnk you are facing duplicate field extractions, as mentioned in this post, please have a look.
Hi @Nisha18789 ,
I have added that props.conf stanza only on Universal forwarder.
From UF, the system forward data to HF and then to Indexer.
And I didn't added the same stanza to HF or Indexer. I just added that to my UF only.
And I checked the post you linked.. and changed my props.conf file like below and ran python script again
But the data still results in duplicated format..