Hi,
I also faced a similar issue a while ago.
I believe the JSON rows are getting duplicated in the SH UI.
Possibly, this is due to multiple JSON parsing for the source type due to splunk config file precedence.
Kindly check on the btool configuration to troubleshoot the issue
Use the below command to see the conf for source type.
1)Go to your Splunk bin directory where your app resides.
2) ./splunk btool props list --debug | grep "your source type"
3)See if the JSON conf are coming from a higher precedence file.
4)Set the KV_MODE=none and AUTO_KV_JSON=false based on this.
Hope this helps!!
dP
... View more