This message originated from Cribl Community Slack.
Click here to view the original link.
i have a situation in search/LHE where fields are getting duplicated, and the duplicated ones are prefixed with the phrase “data_“. Anyone ever see that? The datatype that I want is being used.
Links for this message:
image.png
Solved
Search LHE Field Duplication Issue With Prefix "data_"
Best answer by Jon Rust
i believe that happens when you've got extracted fields that were present outside of _raw, and the same fields in _raw, then _raw is parsed by your dataset rule
i believe that happens when you've got extracted fields that were present outside of _raw, and the same fields in _raw, then _raw is parsed by your dataset rule
Sign up
Already have an account? Login
Login to the community
No account yet? Create an account
Using your Cribl Curious or University Account
User Login Employee loginEnter your E-mail address. We'll send you an e-mail with instructions to reset your password.