JSON logs are being indexed in Splunk, but why are fields not parsed automatically unless I use the spath command in a search?

[anthonycopus]

I have some simple, correctly designed, JSON logs being sent to Splunk.

However, Splunk is not automatically parsing the fields unless I add | spath to the search. What configuration do I need to change so I could simply do:

index=main event_name=demo

instead of

 index=main | spath | event_name=demo

Thanks!

[jplumsdaine22 · Accepted solution]

Have you got KV_MODE=json in your props.conf for that sourcetype?

See http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Propsconf

[anthonycopus]

Thanks, exactly what I needed!