Afternoon,
We are currently having issues with duplicate JSON entries on our search heads which operate in a clustered set up. I understand this is due to the data being read at index time and at search time, hence duplicating the fields.
I have read many other forums with similar issues. The fix suggested is to ensure to set the below in the props.conf on the search heads which we have deployed via an app.
KV_MODE = none
AUTO_KV_JSON = false
while keeping just the below on the props.conf on the forwarder;
INDEXED_EXTRACTIONS = JSON
We have successfully tested this in a non clustered environment and it seems to work but in a clustered set up we are still seeing the duplicate values.
Any help or guidance would be greatly appreciated.
