I came across http://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html which seemed to describe perfectly the issue, but I've been unable to resolve - as far as I can see, KV_MODE is already set to none.
On our collectors, we have an app with props.conf as follows:
[fundapps_logs]
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = datetime
TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l
INDEXED_EXTRACTIONS = json
TRUNCATE = 20000
KV_MODE = none
however, we see two sets of fields in results when we search (but not for the built in splunk fields). If I then do
sourcetype=fundapps_logs | extract
I then see three sets of fields in results. I'm guessing I've got a config issue somewhere.
I've tried adding the same app and props.config to the splunk search/web head (everything runs on a single machine), and restarting but it doesn't appear to have any impact.
Any suggestion?
