Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: When adding "KV_MODE=none" to props.conf, how ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am looking for assistance with unwanted fields extracted automatically.
I am using a custom sourcetype that I added with a field extraction based on regex. This regex extracts four fields: "thread_name", "log_level", "event_category", and "messages". This works correctly, except for when I click the "xx more fields" link under Interesting Fields in the sidebar of search. That is where I see the unwanted fields are listed, and when I examine an event with one of those fields, I can see the field/value pairs are listed under the Event. The four fields specified in my regex are extracted correctly; I just want to suppress the extraction of the "fields" from within the SQL queries.
Following the advice from another post, I added KV_MODE=none to props.conf on the forwarder and reindexed the data, but the issue still occurred. I then added KV_MODE=none to props.conf on the indexer, and reindexed the data, but I am still seeing key/value pairs extracted from the SQL queries.
Can you please advise me of any other recommendations to stop this from happening?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I verified no data re-indexing is required. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to deploy this to your Search Head tier, not the Indexers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The deployment consists of a single server running Splunk Enterprise, and forwarders installed on various hosts. Can you confirm if need to deploy this at $SPLUNK_HOME/etc/apps/search/local/props.conf on the server ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I deployed it to $SPLUNK_HOME/etc/apps/search/local/props.conf and it worked. Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The KV_MODE=none is the search time field extraction setting and should be set on the Search Head. No data re-indexing is required.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you restart the Splunk service after making those props changes?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. I restarted the Splunk service on the forwarder, and stopped/started Splunk on the indexer.
Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco
Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data
Your summer travels continue with new course releases
