How to extract JSON at index time?

[adexteracc]

I am trying to extract some json data at index time. I have found the article about using regular expressions to create custom fields but regex is not well suited to extracting json. I understand that spath can take out the json data during a search but in this case it is required that I extract the data into fields at index time.

[jluo_splunk]

You can ingest the data using the _json sourcetype - this will enable indexed field extractions.

Alternatively, if you don't want to keep the _json sourcetype name, you can set INDEXED_EXTRACTION=JSON in props.conf.

[hortonew]

Have you already tried applying INDEXED_EXTRACTIONS=JSON in your props.conf at your universal forwarder level (or wherever the input is configured)?