Why are Splunk Fields showing 200%?

[HarperWCurran]

Hi,

i am doing a search and noticing that i am getting 200% on the fields i troubleshooted and used this line at the beginning of my search 

KV_MODE = none
AUTO_KV_JSON = false

 however it instead returns with no events what so ever and i have the time on all time yet i still get nothing

please help 

[gcusello]

Hi @HarperWCurran,

as @yuanliu said, these are options for props.conf, if you put them in the beginning of your search you're searching for these strings and obviously you don't find anything.

Could you share your search and a screenshot of the 200%?

Have you multivalues fields?

Ciao.

Giuseppe

[yuanliu]

Those expressions are meant for props.conf, not in search language.  You need to check that sourcetype in props.conf to make sure that you don't have duplicate extraction.