Modify json structure for sourcetype that has indexed_extractions=json

[hortonew]

We have a single Splunk instance with custom scripted input that pulls down json, and has indexed extractions.

New fields were added to the json that aren't getting extracted. We want to be able to remove the known headers that Splunk knows of (what fields to extract), so that it can start over and pick up newly added fields. Is there any method of doing this?

Are our only options: 1) change sourcetype or 2) use search time extractions?

[woodcock]

It does not work like that. Splunk does not cache headers for INDEXED_EXTRACTIONS. If it seems to be doing so, try deleting the file so that it is rewritten with a fresh header line.

[hortonew]

Which file?

[woodcock]

The file that you are monitoring in your inputs.conf:

[monitor:///Your/Path/To/YourFileHere]

[hortonew]

All I can find in the docs is:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata
No support for mid-file renaming of header fields
Some software, such as Internet Information Server, supports the renaming of header fields in the middle of the file. Splunk software does not recognize changes such as this. If you attempt to index a file that has header fields renamed within the file, the renamed header field is not indexed.