When I search for _json sourcetype, I am not getting the results as highlighted

[mintughosh]

When I search for _json sourcetype, I am not getting the results as highlighted like json sourcetype should have been, I tried the following options on props.conf in Heavy forwarder where the Rest API modular input is installed

[_json]
kv_store = JSON
Index_extractions = json

I have tried all the above options but still not working

[MuS]

Hi mintughosh,

is this a typo kv_store = JSON?

You should either use KV_MODE = json which is a search time setting on the search head
OR
INDEXED_EXTRACTIONS = JSON on your input instance, see the docs for more details http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline#S...

Hope this helps ...

cheers, MuS

[mintughosh]

yes, that was a typo. Ok. I wil try to make the changes on the Search head clusters and see if it works