Parsing Issues - Splunk Troubleshooting Use Case - 18

14.06.24 07:02 PM - By Murugan

Parsing Issues

Issue: CSV Event Data is extracting twice
Root Cause: Sourcetype is having improper configuration (e.g: Here, INDEXED_EXTRACTIONS & KV_MODE have the same value)
Solution: Make sure any one of the property is having none (INDEXED_EXTRACTIONS & KV_MODE)

Murugan