KV_Mode against Constant value host fields

[MFiller90]

I have a new data source that extracts quite well using KV_mode = auto (or KV_Mode=json).

The data itself is a simple KV pair: "host:" "host-value"

I would think that Splunk would pick up on the fact that there's a host field already extracting with the KV mode. But it seems to interfere with the "constant value" set for host field value from the "Add Data" GUI.

I can also set the inputs stanza manually, but I see dual entries for my host values for each event. host value 1 = actual_host_in_the_data and host value 2 = my_full_splunk_instance.

I tried setting a host override using a TRANSFORMS, but nothing changes. The only thing I can think of is that the KV mode is an index time extraction, and so is TRANSFORMS. Trying to overwrite a field that doesnt exist yet at index-time isnt working.

Thoughts?

[somesoni2]

The KV_MODE is search time field extraction. The default host values (set at forwarder level or overridden at parsing level using TRANSFORMS on HF/indexer) is metadata field generated at indexed time. Due to same field being extracted twice, it's value will be shown as multivalued field (with two values in your case). What you can do is to set the TRANSFORM (index time configuration) to override default host attribute (which generally is forwarder name) to use the value from your event data, so that both values are same and do not show up as multivalued field. See this:
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/Overridedefaulthostassignments

[MFiller90]

Yes, this is what i meant by doing a host override using transforms.

I've also tried to do a SEDCMD to change it from host to hostname, and then doing the same TRANSFORMS operation.

Both operations end up with duplicate host values (in my scenario)