Apply spath automatically to a sourcetype with nested JSON

[Motoko89]

Hi all, I have JSON events with complex properties, aka nested JSON objects. I know how to apply spath and create macro. But I want to apply the macro automatically to the sourcetype. Something similar to automatic lookup. How do I do this? Thanks,

EDIT:
I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 value without doing spath?

[woodcock]

The other way is to props.conf on your search head(s) with:

[YourSourcetypeHere]
KV_MODE = json

[nikita_p]

Hi,
Please find the accepted answers in below link on splunk answers, this might help you:
https://answers.splunk.com/answers/202023/is-it-possible-to-create-a-macro-to-do-this.html

[Motoko89]

Hi, I don't think it does. Please see my edit

[harsmarvania57]

Hi,

Question title and descriptions bit misleading, please find below comment based on Question title Apply spath automatically to a sourcetype with nested JSON

If you only want to apply spath to extract all fields from Nested JSON then I'll suggest to ingest data with JSON extractions.

If you are forwarding data from Universal Forwarder then use below configurations on UF.

props.conf

[yoursourcetype]
INDEXED_EXTRACTIONS = JSON

[Motoko89]

No, it is exactly what I want. I already have INDEXED_EXTRACTIONS. I can search first-level fields just fine. But some of these fields are of type JSON object. Example:

    {
      "field1": "stringValue",
      "field2": [
         {
             "field2_field1": 20
         }
      ]
     }

How do I search field2_field1 without doing spath?

[harsmarvania57]

I have ingested above sample data in my lab environment with INDEXED_EXTRACTIONS = JSON and it extracted nested JSON as well with field name field2{}.field2_field1

To access this field easily for further usage in stats or any other command it will be good to rename it like | rename field2{}.* as * and after that you will able to see field called field2_field1 in Interesting fields.

[Motoko89]

Thanks! This works for me