Hi All, When we doing a splunk search in our application (sh_app1), we noticed some fields are duplicated / double up (refer: sample_logs.png) if we do the same search in another application (sh_we...
See more...
Hi All, When we doing a splunk search in our application (sh_app1), we noticed some fields are duplicated / double up (refer: sample_logs.png) if we do the same search in another application (sh_welcome_app_ui), we do not see any duplication for the same fields. cid Perf-May06-9-151xxx level INFO node_name aks-application-xxx SPL being used. index=splunk_idx source= some_source
| rex field=log "level=(?<level>.*?),"
| rex field=log "\[CID:(?<cid>.*?)\]"
| rex field=log "message=(?<msg>.*?),"
| rex field=log "elapsed_time_ms=\"(?<elap>.*?)\"" | search msg="\"search pattern\""
| table cid, msg, elap The event count remains same if we search inside that app or any other app, only some fields are duplicated. We couldn't figure out where the actual issue is. Can someone help?