According to documentation here, under the title "Clear a setting":
https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Howtoeditaconfigurationfile
A configuration setting that appears in default can be overridden by an empty setting in local. This often works for things like FIELDALIAS, EVAL, EXTRACT, REPORT and others except I notice it does NOT work for the INDEXED_EXTRACTIONS setting. It looks like the routine that validates this setting will choke if one of the known-good values is not present. So then, if a vendor set INDEXED_EXTRACTIONS=json in their add-on, I might try and set INDEXED_EXTRACTIONS= in the local/props.conf for that same sourcetype, hoping to instead do my JSON on a select few json nodes.
If I did try that, and as Splunk has documented it, then I would find the file would no longer be read in at all. Instead I'd find the following in splunkd.log:
ERROR IndexedExtractionsConfig - Invalid value='' for parameter='INDEXED_EXTRACTIONS'.
and that would be followed by:
ERROR TailReader - Ignoring path="/myvendorApp/logs/filename.log" due to: Invalid indexed extractions configuration - see prior error messages
If anyone knows how to make this work for INDEXED_EXTRACTIONS, please let me know.
