Deployment Architecture

Will INDEXED_EXTRACTIONS = JSON perform the extractions on an All-in-One platform?

actionabledata
Path Finder

All,

Will INDEXED_EXTRACTIONS = JSON perform the extractions on an All-in-One platform?

Here is my props.conf

The sourcetype was executed but none of the fields were extracted.

I can see the fields & values in _raw but they are not listed as fields.

Here is what I see with an adhoc search.
The time "field" within _raw is Jan 5, 2022
I did index the data on 2/22/22 but I am uncertain where the _time field came from. It matches nothing in the data. 
 
actionabledata_2-1645632966977.png

 

 props.conf (no transforms.conf)

# created on 2/22/2022 for a test case using INDEXED_EXTRACTIONS=JSON
# The non-highlighted settings are identical to a known working stanza for the exact same data

[allfields_index_extracted]
INDEXED_EXTRACTIONS = JSON
NO_BINARY_CHECK = true
LINE_BREAKER = ([\r\n]+)
EVENT_BREAKER = ([\r\n]+)
EVENT_BREAKER_ENABLE = true
SHOULD_LINEMERGE = false
TIME_PREFIX = ^"?{""?time""?:
TIME_FORMAT = %s.%6N
MAX_TIMESTAMP_LOOKAHEAD = 17
category = Structured
description = INDEXED_EXTRACTIONS eq JSON
pulldown_type = 1
# Search Time stuff
# Disable search time field extractions since INDEXED_EXTRACTIONS=JSON
KV_MODE = none
AUTO_KV_JSON = false

disabled = false

 Appreciate the help!

 

 

Labels (1)
0 Karma
1 Solution

actionabledata
Path Finder

Turns out that the app containing my master props.conf had been disabled within an app.conf file. Not sure  how, but it was.

Once enabled, the INDEXED_EXTRACTIONS - json worked well on our all in one development platform.

Special thanks to Woodock.

View solution in original post

Tags (1)

actionabledata
Path Finder

Turns out that the app containing my master props.conf had been disabled within an app.conf file. Not sure  how, but it was.

Once enabled, the INDEXED_EXTRACTIONS - json worked well on our all in one development platform.

Special thanks to Woodock.

Tags (1)
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...