Hi,
I am using splunk version 6.3.3 for forwarder and indexers in a clustered environment. Issue is when the search query is executed,it returns multivalue fields with duplicate values.
I have seen few similar posts in the forum ,but could not resolve the issue after referring it. It appears splunk does index time extraction as well as search time extractions of fields here.
Here is the configuration of props.conf on forwarder side :
[event-cache-v2]
category = Structured
KV_MODE = none
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timeStamp
disabled = false
pulldown_type = true
AUTO_KV_JSON = false
On indexer,we tried with multiple combination of props.conf. First having the above config in props.conf and then removing it and trying with just KV_MODE=none and AUTO_KV_JSON = false in props.conf file
But it did not help.
Can you please help us in fixing this issue.
Thanks.
The KV_MODE=none
and AUTO_KV_JSON = false
settings in your props.conf
file must be on your Search Head, too.
Thanks .Yes we added KV_MODE=none. Following is the working configuration that we have now :
Search Head:
system/local
[sourcetype-v2]
KV_MODE=none
Indexer:
system/local
[sourcetype-v2]
KV_MODE=none
Forwarder:
placed in an app
[sourcetype-v2]
INDEXED_EXTRACTIONS = JSON
NO_BINARY_CHECK = true
Thanks.
Perfect, did you restart your Search Head? What you have should work.