Getting Data In

JSON extractions duplicates. Distributed environment.


I have in props.conf this configuration (Universal Forwarder) :

KV_MODE = none
AUTO_KV_JSON = false

But i can clearly see duplicates with this query.

 index=myindex sourcetype=mystats host=myhost | table "precpu_stats.cpu_usage.percpu_usage{}",name,_time,host

Also this query returns 0 results

 index=myindex sourcetype=mystats host=myhost | stats count values(host) values(source) values(sourcetype) values(index) by _raw | WHERE count>1

If i set KV_MODE = json, everything is OK. But dont know, if it is a better solution.
Do I need to setup something on indexers (/master-apps, /apps ) ? or on search head?
I have one master indexer and two slave indexers

Seems its working now.
I had to put /my-addon to search head. BUT, i had to setup permissions (my-addon) to global.
I hope that props.conf above can work vice versa on forwarder and on searchhead too. (so i dont have to have two configs)

0 Karma


I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where:

The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case.

Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...