table returns duplicates for extracted Fields that are not Selected

[johnrk]

table returns duplicates for extracted Fields that are not Selected fields

In the following image, host is a Selected Field which has a single entry, where as the other Fields are automatically extracted (from the events, which is the output of Docker inspect). These extracted fields as seen in the attached image, has two entries. There are two events, and for each event State.Running shows 'true' twice instead of a single 'true'. Why is this happening?

The values are duplicated

[manjunathmeti]

hi @johnrk,
Looks like field values are extracted again during search time. Set KV_MODE to none for the sourcetype on search heads.

props.conf

[DockerInspect]
KV_MODE = none

If this reply helps you, a like would be appreciated.

[johnrk]

Thanks @manjunathmeti for your reply.

I will have to raise a request within our organisation to have this configured on the search head. So its going to be a while before I can let you know if it worked, I'll have to let you know how it goes

It'll be interesting to know if there is a quicker way around this.

[manjunathmeti]

You can evaluate to get and assign the first value in the multivalued fields. Try this:

index=dts_ada sourcetype=sourcetype host=host
| sort -Created
| table host, Name, Created, State.*
| foreach * [ eval <<FIELD>>=mvindex('<<FIELD>>', 0) ] 

If this reply helps you, a like would be appreciated.

[johnrk]

Thanks @manjunathmeti ,

I'm happy to tell you that this works as a quick workaround. It filters out the second value.

The intent of getting a single value was to highlight in Reports the values of 'true' with colour green and 'false' with red. Multivalues was making it impossible as the fields were subindexed within the column.

To use it within a Report xml, I had to endcode the < and > as

| foreach * [ eval <<FIELD>>=mvindex('<<FIELD>>', 0) ]