This message originated from Cribl Community Slack.
Click here to view the original link.
i have a situation in search/LHE where fields are getting duplicated, and the duplicated ones are prefixed with the phrase “data_“. Anyone ever see that? The datatype that I want is being used.
Links for this message:
image.png
Solved
Search LHE Field Duplication Issue With Prefix "data_"
Best answer by Jon Rust
i believe that happens when you've got extracted fields that were present outside of _raw, and the same fields in _raw, then _raw is parsed by your dataset rule
i believe that happens when you've got extracted fields that were present outside of _raw, and the same fields in _raw, then _raw is parsed by your dataset rule
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.