I'm trying to ingest JSON data via the Splunk Add-on for Microsoft Cloud Services app. I created a sourcetype with INDEXED_EXTRACTIONS=json and left all other settings to their default values. The data got ingested, however, when I table my events I start seeing mv fields with duplicate data. I'm even seeing the "Interesting Fields" section add up to 200% (instead of the expected 100%).
* When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also
set 'KV_MODE = json' for that source type. This causes the Splunk software to
extract the JSON fields twice: once at index time, and again at search time.
* Default: not set