Splunk Search

Why is my search on JSON data producing duplicate results for each line, except for the date and time?

Contributor

Hi guys,

I have a problem. Every time I try to run the following search, the result is duplicated in each line, but the date and time. What can be? My log is in format JSON.

index="my_index" source="my_source" sourcetype="my_sourcetype"
| rename field1 , field2, field3, ....
| eval Date = strftime(_time, "%d-%m-%Y")
| eval Hour = strftime(_time, "%H-%M-%S")
| spath output=Rules  path=field.sub-field{}.code
| table Date, Hour, field1 , field2, field3, ....

alt text

0 Karma
1 Solution

Motivator

The data is most likely being indexed with indexed extractions and also searched with search-time extractions. Your indexer props.conf file likely has a line to do indexed extractions (not best practice):
INDEXED_EXTRACTIONS = json
On the search head props.conf:
KV_MODE = json

Deleting "INDEXED_EXTRACTIONS = json" from the indexer will solve the issue for everything indexed after the indexer is restarted. Anything already indexed will retain their indexed extractions, so you might want to delete the indexed data and re-index everything.

View solution in original post

Motivator

The data is most likely being indexed with indexed extractions and also searched with search-time extractions. Your indexer props.conf file likely has a line to do indexed extractions (not best practice):
INDEXED_EXTRACTIONS = json
On the search head props.conf:
KV_MODE = json

Deleting "INDEXED_EXTRACTIONS = json" from the indexer will solve the issue for everything indexed after the indexer is restarted. Anything already indexed will retain their indexed extractions, so you might want to delete the indexed data and re-index everything.

View solution in original post

Motivator

Or index the field and set KVMODE to none.

0 Karma

Motivator

The other solution is to leave it as an indexed field and add KVMODE=false to the search head.

0 Karma

Contributor

landen,

This occurs every time that I try use the command table. I changed the configuration but continuous similarity. Do you have any ideia ?

0 Karma

Esteemed Legend

The table command just accentuates the fact that the fields have multiple/duplicated values. If you do not use table and then click on the field in the left fields panel, you will see that it is also duplicated there, even though you are not using table. This answer is probably the correct explanation.

0 Karma

Contributor

Thanks guys. The solution works fine.

0 Karma