Afternoon, We are currently having issues with duplicate JSON entries on our search heads which operate in a clustered set up. I understand this is due to the data being read at index time and at search time, hence duplicating the fields.  I have read many other forums with similar issues. The fix suggested is to ensure to set the below in the props.conf on the search heads which we have deployed via an app. KV_MODE =  none  AUTO_KV_JSON = false  while keeping just the below on the props.conf on the forwarder; INDEXED_EXTRACTIONS = JSON  We have successfully tested this in a non clustered environment and it seems to work but in a clustered set up we are still seeing the duplicate values.   Any help or guidance would be greatly appreciated.  ... View more

I am trying to create a dash which uses  tokens for different clients capturing any attachments sent externally.    I have extracted the domain name from my search using regex so I can then exclude the internal "to" address  so that all emails being recorded are external.  The exclusion is where I am getting stuck if anyone has any ideas?   index=test  sourcetype="messagetracker" attachments=true client_code=$client$ | eval timestamp=strftime(_time, "%m-%d-%Y %H:%M:%S") | rename fromEnv.emailAddress as from_envelope_address, fromHdr.emailAddress as from_header_address, from.displayableName as from_displayname, fromHdr.displayableName as from_header_displayname, to.displayableName as to_displayname, to{}.displayableName as to_array_displayname, from.emailAddress as from_address, fromHeader.emailAddress as from_header2_address, to.emailAddress as to_address, to{}.emailAddress as to_array_address | search from_envelope_address=* | rename to_array_address as to | rename from_envelope_address as from |search to="***" from="***" | rex field=from "\@(?<domain>[^ ]*)" |search NOT (to in domain) | dedup from,to, subject, status, info, route | fillnull value="n/a" from_header_address | table timestamp, from, to,domain, attachments, status, info, route, spamScore, client_code ... View more