Getting Data In

Duplicate values but one key

mrstrozy
Path Finder

Hi,

I am running into an issue where I have keys and values which will show up once; upon expansion however it shows that there are two values for each key. The only fields that have the two values are under the 'Event' type.

Here is an example of what I see:

alt text

and then expanded:

alt text

And here is an example souretype configuration that is on one of my forwarders:

[blahblah]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
AUTO_KV_JSON = false
NO_BINARY_CHECK = true
TZ = UTC
category = structured

Does anyone have any idea of what is going on?

0 Karma

pruthvikrishnap
Contributor
INDEXED_EXTRACTIONS = json
 KV_MODE = none
 AUTO_KV_JSON = false
 TIME_PREFIX = "timestamp"
 MAX_TIMESTAMP_LOOKAHEAD = 50
 NO_BINARY_CHECK = true
 SHOULD_LINEMERGE = false
 TIMESTAMP_FIELDS = timestamp
 category = Structured

Try this. i see that the fields are being extracted twice.
Let me know if this works.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...