Duplicate metadata fields in Splunk when streaming logs via Vector

[ShravanAccept]

Duplicate metadata fields in Splunk when sending Appian logs via Vector

I’m streaming Appian logs to Splunk using Vector. The log events themselves look fine, but the metadata fields are being duplicated.

This started happening after I changed the sourcetype indexing in sinks to a different relevant field from the transform file. Since then, Splunk shows each metadata value twice.

I tried adjusting the sink configuration by trial and error, but I’m not sure how Splunk is interpreting these fields or why they’re duplicated.

Is this a known behavior? How can I configure Vector so that the metadata fields are not duplicated when sending Appian logs?

If needed i can add config also here

Vector Config

type = "splunk_hec_logs"
We are using the above sink

Vector Logs

No response