I have ingested JSON data & Splunk has extracted important fields automatically, but I see some mismatch between Key-Value & Count. There are many such fields with mismatch in count.
As per my screenshot for a single event, "Count" should be 1 instead of 2. Could someone advise me how to fix this problem.
(i don't see any problem with host, source, sourcetype)
[json] KV_MODE = json INDEXED_EXTRACTIONS = JSON TRUNCATE = 0 TIME_PREFIX = startTime": MAX_TIMESTAMP_LOOKAHEAD = 16 SHOULD_LINEMERGE = False NO_BINARY_CHECK = 0
Here is an event. Important fields have been extracted by Splunk. e.g corCallHeader.firstCellId=1.
Then I have used Alias to change it to Cell_ID.
P.S - deleting original log
If you can mask all the sensitive data, that should do. I'm interested in seeing the format of jSON with the mentioned field. On cursory look, the configuration looks correct. One question though, is this a custom sourcetype? and if yes, could you try renaming it to something else?