Duplicate values in Cisco DNA logs

[AlonsoHM]

Thank you in advance for your help community

I performed the integration of Cisco DNA to Splunk

• Created my "cisco_dna" index on my Heavy Forwarder
• I installed the Cisco DNA Center Add-on on my Heavy Forwarder (https://splunkbase.splunk.com/app/6668)
• Added the account in the add-on (username, password, host)
• Activated all the inputs:
  • cisco:dnac:clienthealth
  • cisco:dnac:devicehealth
  • cisco:dnac:compliance
  • cisco:dnac:issue
  • cisco:dnac:networkhealth
  • cisco:dnac:securityadvisory

• I also created my “cisco_dna” index on my Splunk Cloud instance.
• Installed the Cisco DNA Center App (https://splunkbase.splunk.com/app/6669)
• Done, I started receiving logs in Splunk from Cisco DNA

But when validating the dashboards in the APP and reviewing the search results I noticed that the values of the fields are duplicated.

Even if I apply some dedup to any of the fields, the result is “only one duplicate value”.

This affects me when I have to take a value to perform an operation or make a graph.

Does anyone know what this problem is due to and how I could solve it?

Cisco DNA Center Add-on Cisco DNA Center App 

[mlhadmin]

I don't like that this add-on is using INDEXED_EXTRACTIONS by default, with no seemingly easy way to switch from using them with the way that the scripted input works... Hopefully this will be improved now that Cisco owns Splunk...

[bowesmana]

This is probably an INDEXED_EXTRACTIONS issue, see these, which should help

https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-on-JSON-data-producing-duplicate-resu...

https://community.splunk.com/t5/Getting-Data-In/Bug-Why-are-there-duplicate-values-with-INDEXED-EXTR...

https://community.splunk.com/t5/Getting-Data-In/Why-would-INDEXED-EXTRACTIONS-JSON-in-props-conf-be-...