https://community.splunk.com/t5/Getting-Data-In/Fields-Extraction-from-JSON-File/m-p/482760#M82711 <P>Check this out, <A href="https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html" target="_blank">https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html</A></P> <P>The props.conf has to be on the UF with the INDEXED_EXTRACTIONS and the props also has to be on the SH with the KV_MODE=NONE</P> Wed, 30 Sep 2020 05:08:21 GMT wwhite12 2020-09-30T05:08:21Z https://community.splunk.com/t5/Getting-Data-In/Fields-Extraction-from-JSON-File/m-p/482759#M82710 <P>Im monitoring a JSON file and forwarding the data using UF to my indexers . Im having problems to extract the JSON fields . Here is my props file . Nothing is being extracted ( i was trying to upload a screenshot but i dont have enought points ) . i know its something with the props but im unable to figure it out . any help would be appreciated </P> <P>[test]<BR /> DATETIME_CONFIG = <BR /> INDEXED_EXTRACTIONS = json<BR /> KV_MODE = none<BR /> LINE_BREAKER = ([\r\n]+)<BR /> NO_BINARY_CHECK = true<BR /> category = Structured<BR /> disabled = false<BR /> pulldown_type = true</P> <P>Thanks </P> Wed, 30 Sep 2020 05:08:19 GMT https://community.splunk.com/t5/Getting-Data-In/Fields-Extraction-from-JSON-File/m-p/482759#M82710 newsplunker1 2020-09-30T05:08:19Z https://community.splunk.com/t5/Getting-Data-In/Fields-Extraction-from-JSON-File/m-p/482760#M82711 <P>Check this out, <A href="https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html" target="_blank">https://answers.splunk.com/answers/556279/why-would-indexed-extractionsjson-in-propsconf-be.html</A></P> <P>The props.conf has to be on the UF with the INDEXED_EXTRACTIONS and the props also has to be on the SH with the KV_MODE=NONE</P> Wed, 30 Sep 2020 05:08:21 GMT https://community.splunk.com/t5/Getting-Data-In/Fields-Extraction-from-JSON-File/m-p/482760#M82711 wwhite12 2020-09-30T05:08:21Z