JSON extractions duplicates. Distributed environment.

[Rialf1959]

Hello,
I have in props.conf this configuration (Universal Forwarder) :

INDEXED_EXTRACTIONS = json
KV_MODE = none
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
AUTO_KV_JSON = false

But i can clearly see duplicates with this query.

 index=myindex sourcetype=mystats host=myhost | table "precpu_stats.cpu_usage.percpu_usage{}",name,_time,host

Also this query returns 0 results

 index=myindex sourcetype=mystats host=myhost | stats count values(host) values(source) values(sourcetype) values(index) by _raw | WHERE count>1

If i set KV_MODE = json, everything is OK. But dont know, if it is a better solution.
Do I need to setup something on indexers (/master-apps, /apps ) ? or on search head?
I have one master indexer and two slave indexers
Thanks

EDIT:
Seems its working now.
I had to put /my-addon to search head. BUT, i had to setup permissions (my-addon) to global.
I hope that props.conf above can work vice versa on forwarder and on searchhead too. (so i dont have to have two configs)

[mdsnmss]

I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F.

The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case.

Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step.