Splunk Search

Each extracted field multivalue with duplicate values for JSON events

amoldesai
Explorer

Hi,

I am using splunk version 6.3.3 for forwarder and indexers in a clustered environment. Issue is when the search query is executed,it returns multivalue fields with duplicate values.

I have seen few similar posts in the forum ,but could not resolve the issue after referring it. It appears splunk does index time extraction as well as search time extractions of fields here.

Here is the configuration of props.conf on forwarder side :

[event-cache-v2]
category = Structured
KV_MODE = none
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timeStamp
disabled = false
pulldown_type = true
AUTO_KV_JSON = false

On indexer,we tried with multiple combination of props.conf. First having the above config in props.conf and then removing it and trying with just KV_MODE=none and AUTO_KV_JSON = false in props.conf file

But it did not help.

Can you please help us in fixing this issue.

Thanks.

Tags (1)
0 Karma

woodcock
Esteemed Legend

The KV_MODE=none and AUTO_KV_JSON = false settings in your props.conf file must be on your Search Head, too.

amoldesai
Explorer

Thanks .Yes we added KV_MODE=none. Following is the working configuration that we have now :

Search Head:
system/local
[sourcetype-v2]
KV_MODE=none

Indexer:
system/local
[sourcetype-v2]
KV_MODE=none

Forwarder:
placed in an app
[sourcetype-v2]
INDEXED_EXTRACTIONS = JSON
NO_BINARY_CHECK = true

Thanks.

0 Karma

woodcock
Esteemed Legend

Perfect, did you restart your Search Head? What you have should work.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...