Thanks @gcusello  will get it checked. ... View more

Sure @gcusello  Sample event: { [-]    application: uslcc-nonprod    cluster: AKS-SYD-NPDI1-ESE-2    container_id: 9ae09dba5f0ca4c75dfxxxxxxb6b1824ec753663f02d832cf5bfb6f0dxxxxxxx    container_image: acrsydnpdi1ese.azurecr.io/ms-usl-acct-maint:snapshot-a23584a1221b57xxxxxb437d80xxxxxxb6e65    container_name: ms-usl-acct-maint    level: INFO    log: 2024-05-06 11:08:40.385 INFO 26 --- [org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1] [CID:Perf-May06-9-151615] l.AccountCreditLimitChangedKafkaListener : message="xxxxx listener 'account credit limit event enrichment'", elapsed_time_ms="124"    namespace: uslcc-nonprod    node_name: aks-application-3522xxxxx-vmss0000xl    pod_ip: 10.209.82.xxx    pod_name: ms-usl-acct-maint-ppte-7dc7xxxxxx-2fc58    tenant: uslcc    timestamp: 2024-05-06 11:08:40.385 }   Raw:   {"log":"2024-05-06 11:08:40.385 INFO 26 --- [org.springframework.kafka.KafkaListenerEndpointContainer#0-0-C-1] [CID:Perf-May06-9-151615] l.AccountCreditLimitChangedxxxxxListener : message=\"xxxxx listener 'account credit limit event enrichment'\", elapsed_time_ms=\"124\"","application":"uslcc-nonprod","cluster":"AKS-SYD-NPDI1-ESE-2","namespace":"uslcc-nonprod","tenant":"uslcc","timestamp":"2024-05-06 11:08:40.385","level":"INFO","container_id":"9ae09dba5xxxxxfd2724b6b1824ec753663f02dxxxxxf0d55d59940","container_name":"ms-usl-acct-maint","container_image":"acrsydnpdi1ese.azurecr.io/ms-usl-acct-maint:snapshot-a23584a1221b5749xxxxxd803eb2aabaxxxxx5","pod_name":"ms-usl-acct-maint-ppte-7dc7c9xxxxc58","pod_ip":"10.209.82.xxx","node_name":"aks-application-35229300-vmssxxxxxl"} ... View more

Hello @gcusello  But source doesn't contain any duplicate fields while sending to Splunk & they are appearing  only if we search within particular app.  As said earlier, If I run the same query outside the app, I don't see these duplicate field values. My users don't have permissions to run the searches outside their app so they see duplicate entries every time.  ... View more

Hi @gcusello  Thanks, however actual issue is fields duplication. Please find the attached screenshot and you will see some fields contains duplicate values (cid, cluster, container_id, container_name etc).  I'd like to understand why they are showing 2 values instead of one.  ... View more

Hi @gcusello  Thanks for the reply. using stats helps in removing the duplicate values in "statistics" tab.  However, the duplicate fields are still appearing in "Events" tab.  I don't understand how it's happening. Ps. Due to unknown reasons I can't attach images. ... View more

Thanks a lot for the response @gcusello , it works. ... View more

Hi @gcusello  I used the same search which you shared above and didn't made any changes. I will share the screenshot shortly as I am getting some errors in uploading the picture. ... View more

Hello @gcusello  Thanks for the response. Unfortunately, I see only empty values for sourcetype column.  other 3 fields showing the info.  ... View more

Hello @gcusello  Thanks a lot for the swift response. the query gives the most of info I was looking for. However, it contains multiple entries for single index. Lets say If Index A has 3 sourcetypes, it appears in 3 rows.  Can we group them in a single row?  e.g: _time index sourcetype Vol_GB percentage 17th Sep Main  st1 st2 st3 100G 10.00% ... View more