Scribd Logo
Upload

Welcome to Scribd!

  • Use Case-18 - Troubleshooting

    Uploaded by

    junaid
    9 views5 pages
    The document discusses a parsing issue where CSV event data is being extracted twice. The root cause is that the sourcetype has an improper configuration where the INDEXED_EXTRACTIONS and KV_MODE properties have the same value. The solution is to ensure that one of these properties has a value of "none".

    Original Description:

    Original Title

    Use case-18 - Troubleshooting

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document discusses a parsing issue where CSV event data is being extracted twice. The root cause is that the sourcetype has an improper configuration where the INDEXED_EXTRACTIONS and KV_MODE properties have the same value. The solution is to ensure that one of these properties has a value of "none".

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    9 views5 pages

    Use Case-18 - Troubleshooting

    Uploaded by

    junaid
    The document discusses a parsing issue where CSV event data is being extracted twice. The root cause is that the sourcetype has an improper configuration where the INDEXED_EXTRACTIONS and KV_MODE properties have the same value. The solution is to ensure that one of these properties has a value of "none".

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 5

    Splunk Enterprise

    Troubleshooting
    Use Cases

    18
    Soft Mania

    Parsing Issues
    Issue: CSV Event Data is extracting
    twice

    _time server_name cpu

    ORADB_135 45
    2024-03-04 11:15:43.567
    ORADB_135 45

    ORADB_248 78
    2024-03-04 11:15:43.567
    ORADB_248 78

    @SoftMania #SoftMania
    Soft Mania

    Parsing Issues
    Root Cause:
    Sourcetype is having improper configuration
    (e.g: Here, INDEXED_EXTRACTIONS & KV_MODE has same value)

    @SoftMania #SoftMania
    Soft Mania

    Parsing Issues
    Solution:
    Make sure any one of the property is having none,
    (INDEXED_EXTRACTIONS & KV_MODE)

    @SoftMania #SoftMania

    You might also like