Getting Data In

Are there inconsistencies in behavior with the need for INDEXED_EXTRACTIONS?

ddrillic
Ultra Champion

The admin class (lab) says that for json we need the following in the props.conf of the forwarder.

INDEXED_EXTRACTIONS=json

However, I know that for json all works fine even if INDEXED_EXTRACTIONS=json is only at the indexer level and maybe even that is not needed.

Recently at Why does the csv sourcetype work for upload but not via the forwarder?

We realized that INDEXED_EXTRACTIONS = csv is absolutely needed at the forwarder level.

Why is that? It seems that not all pre-defined sourcetypes are treated equally.

0 Karma

ddrillic
Ultra Champion

A related one at Why would INDEXED_EXTRACTIONS=JSON in props.conf be resulting in duplicate values?

@mmodestino says -
- If you use INDEXED_EXTRACTIONS, the props.conf needs to be on the UF

The context is json.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

If you use INDEXED_EXTRACTIONS, you need to make sure you disable any search time field extractions for the same sourcetype.
If you specify INDEXED_EXTRACTIONS=json and KV_MODE=auto/json, for example, you will get duplicate values, because the same fields are extracted twice.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...