We ended up doing below which works the way we want i.e. no duplicate json values.
On UF, do NOT define any props.
On Indexers, nothing specific to JSON props, but we had defined props related time field
[my_sourcetype]
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=14000
TIME_PREFIX=timestamp":"?
On SH, do NOT define any props
With this set up, The JSON values are by default extracted in Indexing layer. Because on Indexers, this property is set up in system/default location.
[default]
AUTO_KV_JSON = true
... View more