Splunk Search
Highlighted

Duplicate Extracted Fields (ingest through HEC)

Path Finder

Hi, I am seeing duplicate extractions for events in my Splunk instance. To give a background, I have a couple forwarders (which are mostly not used), an indexer cluster in which each indexer is running the Splunk HEC and the HEC is sitting behind a load balancer, I have one index cluster master and finally I have a search head cluster.

There is not a props.conf file on the search heads.

Currently the props.conf lives in the /opt/splunk/etc/system/local/ directory on the indexers. Here is a sample config:

[mycustomsourcetype]
DATETIMECONFIG =
INDEXED
EXTRACTIONS = json
KVMODE = none
AUTO
KVJSON = false
LINE
BREAKER = ([\r\n]+)
NOBINARYCHECK = true
TZ = UTC
category = Structured
description = ticket stuff
disabled = false
TRUNCATE = 0
pulldown_type = true

Considering the only props.conf that I believe should be dictating extractions is on the indexers, I'm very confused about how to fix this.

Any help would be greatly appreciated. Thanks!

0 Karma
Highlighted

Re: Duplicate Extracted Fields (ingest through HEC)

SplunkTrust
SplunkTrust

Hi,

Please configure below props.conf on Search Head.

[mycustomsourcetype]
KV_MODE = none
0 Karma
Highlighted

Re: Duplicate Extracted Fields (ingest through HEC)

Path Finder

The part I forgot to mention was that the events ingested prior to the architecture change did not have duplicate extractions which added to the confusion. I noticed that the replication and search factors were not being met and so I explicitly added to the master server.conf clustering section with "replication_factor = 3" (though I thought this was the case by default). After doing so the replication and search factors were then met and all ingested events from that point on did not have duplicate field extractions.

I am pretty confused by this so anyone with more advanced knowledge please feel free to chime in. I would love to fully understand why this was the case.

0 Karma
Highlighted

Re: Duplicate Extracted Fields (ingest through HEC)

Esteemed Legend

Set this on your Search Head:

props.conf

[mycustomsourcetype]
KV_MODE = none
AUTO_KV_JSON = false
Highlighted

Re: Duplicate Extracted Fields (ingest through HEC)

Path Finder

I needed both KVMODE and AUTOKV_JSON, thanks @woodcock!

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.