Splunk Search

Why are my json fields extracted twice? (redux)

jamescrowley
New Member

I came across http://answers.splunk.com/answers/174939/why-are-my-json-fields-extracted-twice.html which seemed to describe perfectly the issue, but I've been unable to resolve - as far as I can see, KV_MODE is already set to none.

On our collectors, we have an app with props.conf as follows:

[fundapps_logs]
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = datetime
TIME_FORMAT = %m-%d-%Y %H:%M:%S.%l
INDEXED_EXTRACTIONS = json
TRUNCATE = 20000
KV_MODE = none

however, we see two sets of fields in results when we search (but not for the built in splunk fields). If I then do

sourcetype=fundapps_logs | extract

I then see three sets of fields in results. I'm guessing I've got a config issue somewhere.

I've tried adding the same app and props.config to the splunk search/web head (everything runs on a single machine), and restarting but it doesn't appear to have any impact.

Any suggestion?

0 Karma

woodcock
Esteemed Legend

Did you deploy this to your Indexers and after that did you restart all Splunk instances on the Indexers?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Not sure if you still have this problem, but the answer to this problem is here

https://answers.splunk.com/answers/301893/why-are-several-json-fields-getting-extracted-more.html

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...