Below is sample data . How to remove the duplicate values
Below configuration will help to remove duplicates in JSON events.
props.conf in Indexer
[<source_type>] INDEXED_EXTRACTIONS = json category = Structured
props.conf in Search head
[<source_type>] AUTO_KV_JSON = false KV_MODE = none
This answer is based on input from @harsmarvania57. Thanks.
Kindly accept the answer if it helped you, so others can refer it.
It looks like you are using
INDEXED_EXTRACTIONS = json and
KV_MODE = json. If you are using
INDEXED_EXTRACTIONS = json while ingesting the data then set
KV_MODE = none on Search Head and it will not display duplicate value.
@Nadhiyaa, are you using
dedup ? You shouldnt have duplicated if that's the case. Could you please post your query.