I have json being input to Splunk and the JSON is being parsed ok. At least the events show up with collapsed fields in the list of events. But none of the JSON fields are showing up as "interesting fileds" which makes me wonder if the JSON is being properly parsed. From the documentation I read that if I set:
KV_MODE = json
that it's "Used for search-time field extractions only" and "automatically extracts fields from JSON data" which leads me to expect that the JSON fields would show up in "interesting fields".
However that's not the case. Here's my props.conf file