Getting Data In

JSON extractions duplicates. Distributed environment.


I have in props.conf this configuration (Universal Forwarder) :

KV_MODE = none
AUTO_KV_JSON = false

But i can clearly see duplicates with this query.

 index=myindex sourcetype=mystats host=myhost | table "precpu_stats.cpu_usage.percpu_usage{}",name,_time,host

Also this query returns 0 results

 index=myindex sourcetype=mystats host=myhost | stats count values(host) values(source) values(sourcetype) values(index) by _raw | WHERE count>1

If i set KV_MODE = json, everything is OK. But dont know, if it is a better solution.
Do I need to setup something on indexers (/master-apps, /apps ) ? or on search head?
I have one master indexer and two slave indexers

Seems its working now.
I had to put /my-addon to search head. BUT, i had to setup permissions (my-addon) to global.
I hope that props.conf above can work vice versa on forwarder and on searchhead too. (so i dont have to have two configs)

0 Karma


I see you got it working. In regards to your edit, I'm afraid you will need configs on both your forwarder and search head to accomplish this. This doc might help figuring out which configurations go where:

The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case.

Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...