search simple json

[vashodha]

I tried many ways to generate a properly formated json for splunk to parse it so i can put some alerts on my data but  no  success yet  , nad the log is really simple 

2021-02-19T18:35:43,878Z [main] INFO dev-AniMatchIngester - { "createTS":"2021-02-19T10:35:43Z", "accountId":"333333", "correlationId":"1112222", "msgType":"raw_published", "Outcome":"Success", "eventOccurrenceTimestamp":"2020-01-14 08:12:07.111", "Type":"TEST", "eventType":"Success" }

I need to i deally want these fields in intresting fields section or at the least i should be able to do a meaning queries based on eventOccurrenceTimestamp  > today etc., or Type =="test" comparisons it was so easy in elk .  

[to4kawa]

https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p...