index=myindex sourcetype=mystats host=myhost | stats count values(host) values(source) values(sourcetype) values(index) by _raw | WHERE count>1
If i set KV_MODE = json, everything is OK. But dont know, if it is a better solution.
Do I need to setup something on indexers (/master-apps, /apps ) ? or on search head?
I have one master indexer and two slave indexers
Seems its working now.
I had to put /my-addon to search head. BUT, i had to setup permissions (my-addon) to global.
I hope that props.conf above can work vice versa on forwarder and on searchhead too. (so i dont have to have two configs)
The "INDEXED_EXTRACTIONS = json" can take place on the forwarder level. If you have a heavy forwarder instead of universal forwarder you can do the parsing components at the forwarder level as well though it is recommended to do that at the indexers unless there is a specific use case.
Since the fields are set to be indexed at the forwarder/parsing level the "KV_MODE = none" and "AUTO_KV_JSON = false" should be set on the search head to say it does not need to perform search time extractions since the extractions already took place prior to that step.