Getting Data In

JSON extractions duplicates. Distributed environment.

Rialf1959
Explorer

Hello,
I have in props.conf this configuration (Universal Forwarder) :

INDEXED_EXTRACTIONS = json
KV_MODE = none
DATETIME_CONFIG = CURRENT
TRUNCATE = 0
AUTO_KV_JSON = false

But i can clearly see duplicates with this query.

 index=myindex sourcetype=mystats host=myhost | table "precpu_stats.cpu_usage.percpu_usage{}",name,_time,host

Also this query returns 0 results

 index=myindex sourcetype=mystats host=myhost | stats count values(host) values(source) values(sourcetype) values(index) by _raw | WHERE count>1

If i set KV_MODE = json, everything is OK. But dont know, if it is a better solution.
Do I need to setup something on indexers (/master-apps, /apps ) ? or on search head?
I have one master indexer and two slave indexers
Thanks

EDIT:
Seems its working now.
I had to put /my-addon to search head. BUT, i had to setup permissions (my-addon) to global.
I hope that props.conf above can work vice versa on forwarder and on searchhead too. (so i dont have to have two configs)

0 Karma

mdsnmss
SplunkTrust
SplunkTrust

I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where: http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F.

The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case.

Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...