Getting Data In

independent stream forwarder field value duplication problem

luckinfo
Engager

The field value is duplicated in independent Stream forwarder. Is there a workaround?

  • Version Splunk 6.5.5 and independent Stream forwarder 7.1.1

alt text

Tags (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

This looks like INDEXED_EXTRACTIONS = JSON on UF side and KV_MODE = auto (This is default) or KV_MODE = json on search head is present and due to that it is extracting JSON event twice.

You need to set KV_MODE = none on search head for your sourcetype so search head will not extract this JSON event again.

On SH props.conf

[yoursourcetype]
KV_MODE = none

nickhills
Ultra Champion

Is this forwarded with useAck = true set on the forwarders outputs.conf?

If my comment helps, please give it a thumbs up!
0 Karma

nickhills
Ultra Champion

Scratch my comment - i misread 'field duplicated' as 'event duplicated'

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...