Getting Data In

JSON events with INDEXED_EXTRACTIONS making each extracted field multivalue

aknsun
Path Finder

Hi,

I have an issue with JSON events having multivalue fields.

We are using scripted input to ingest the data. The scripted input resides on the collector.

I have the following defined in the props.conf on the collector and no where else

[sourcetype_abc]
INDEXED_EXTRACTIONS = json
KV_MODE = none

Going through a few previous posts, it's being advised that KV_MODE = none need to be placed on the Search Head. Can someone confirm this? Do I also need to make use of AUTO_KV_JSON = false?

So does it need to be as follows:
On Collector

[sourcetype_abc]
INDEXED_EXTRACTIONS = json

On SH
[sourcetype_abc]
KV_MODE = none

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Yes configuration which you provided is correct.

On Collector

[sourcetype_abc]
INDEXED_EXTRACTIONS = json

On SH

[sourcetype_abc]
KV_MODE = none

View solution in original post

harsmarvania57
Ultra Champion

Hi,

Yes configuration which you provided is correct.

On Collector

[sourcetype_abc]
INDEXED_EXTRACTIONS = json

On SH

[sourcetype_abc]
KV_MODE = none

aknsun
Path Finder

@harsmarvania57 Thanks. That worked.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...