Getting Data In

When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped?

New Member

I am looking for assistance with unwanted fields extracted automatically.

I am using a custom sourcetype that I added with a field extraction based on regex. This regex extracts four fields: "thread_name", "log_level", "event_category", and "messages". This works correctly, except for when I click the "xx more fields" link under Interesting Fields in the sidebar of search. That is where I see the unwanted fields are listed, and when I examine an event with one of those fields, I can see the field/value pairs are listed under the Event. The four fields specified in my regex are extracted correctly; I just want to suppress the extraction of the "fields" from within the SQL queries.

Following the advice from another post, I added KV_MODE=none to props.conf on the forwarder and reindexed the data, but the issue still occurred. I then added KV_MODE=none to props.conf on the indexer, and reindexed the data, but I am still seeing key/value pairs extracted from the SQL queries.

Can you please advise me of any other recommendations to stop this from happening?

0 Karma
1 Solution

Esteemed Legend

You need to deploy this to your Search Head tier, not the Indexers.

View solution in original post

0 Karma

New Member

I verified no data re-indexing is required. Thank you!

0 Karma

Esteemed Legend

You need to deploy this to your Search Head tier, not the Indexers.

View solution in original post

0 Karma

New Member

The deployment consists of a single server running Splunk Enterprise, and forwarders installed on various hosts. Can you confirm if need to deploy this at $SPLUNK_HOME/etc/apps/search/local/props.conf on the server ?

0 Karma

New Member

I deployed it to $SPLUNK_HOME/etc/apps/search/local/props.conf and it worked. Thank you!

0 Karma

Revered Legend

The KV_MODE=none is the search time field extraction setting and should be set on the Search Head. No data re-indexing is required.

0 Karma

New Member

Thank you!

0 Karma

SplunkTrust
SplunkTrust

Did you restart the Splunk service after making those props changes?

0 Karma

New Member

Yes. I restarted the Splunk service on the forwarder, and stopped/started Splunk on the indexer.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!