Splunk Search

table returns duplicates for extracted Fields that are not Selected

johnrk
Engager

table returns duplicates for extracted Fields that are not Selected fields

In the following image, host is a Selected Field which has a single entry, where as the other Fields are automatically extracted (from the events, which is the output of Docker inspect). These extracted fields as seen in the attached image, has two entries. There are two events, and for each event State.Running shows 'true' twice instead of a single 'true'. Why is this happening?

The values are duplicatedThe values are duplicated

Labels (3)
Tags (1)
0 Karma

manjunathmeti
Champion

hi @johnrk,
Looks like field values are extracted again during search time. Set KV_MODE to none for the sourcetype on search heads.

props.conf

[DockerInspect]
KV_MODE = none

 

If this reply helps you, a like would be appreciated.

0 Karma

johnrk
Engager

Thanks @manjunathmeti for your reply.

I will have to raise a request within our organisation to have this configured on the search head. So its going to be a while before I can let you know if it worked, I'll have to let you know how it goes

It'll be interesting to know if there is a quicker way around this.

0 Karma

manjunathmeti
Champion

You can evaluate to get and assign the first value in the multivalued fields. Try this:

index=dts_ada sourcetype=sourcetype host=host
| sort -Created
| table host, Name, Created, State.*
| foreach * [ eval <<FIELD>>=mvindex('<<FIELD>>', 0) ] 

 

If this reply helps you, a like would be appreciated.

johnrk
Engager

Thanks @manjunathmeti ,

I'm happy to tell you that this works as a quick workaround. It filters out the second value.

The intent of getting a single value was to highlight in Reports the values of 'true' with colour green and 'false' with red. Multivalues was making it impossible as the fields were subindexed within the column.

To use it within a Report xml, I had to endcode the < and > as

| foreach * [ eval &lt;&lt;FIELD&gt;&gt;=mvindex('&lt;&lt;FIELD&gt;&gt;', 0) ]

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...