Hi,
I am using splunk version 6.3.3 for forwarder and indexers in a clustered environment. Issue is when the search query is executed,it returns multivalue fields with duplicate values.
I have seen few similar posts in the forum ,but could not resolve the issue after referring it. It appears splunk does index time extraction as well as search time extractions of fields here.
Here is the configuration of props.conf on forwarder side :
[event-cache-v2]
category = Structured
KV_MODE = none
INDEXED_EXTRACTIONS = json
DATETIME_CONFIG =
NO_BINARY_CHECK = true
TIMESTAMP_FIELDS = timeStamp
disabled = false
pulldown_type = true
AUTO_KV_JSON = false
On indexer,we tried with multiple combination of props.conf. First having the above config in props.conf and then removing it and trying with just KV_MODE=none and AUTO_KV_JSON = false in props.conf file
But it did not help.
Can you please help us in fixing this issue.
Thanks.
↧