Me and another engineer were taking a look at `index=corelight sourcetype=corelight_notice signature="Scan::*"`.
We noticed that `src` was not properly parsed given `kv_mode=auto`.
We've attempted the follwing four course of action:
1. performed an EXTRACT on _raw as : "src":"(?<src>[^"]+)",
2. performed a REPORT as: corelight_notice_src
* with a transform as `"src":"(?<src>[^"]+)",` on _raq
3. perform an EXTRACT on _raw as : \"src\":\"(?<src>[^\"]+)\",
4. * performed a REPORT as: corelight_notice_src
* with a transform as `* \"src\":\"(?<src>[^\"]+)\",`
Note that performing the `| rex field=_raw "\"src\":\"(?<src>[^\"]+)\","` at search time works fine.
We also attempted with `AUTO_KV_JSON = false` with the above tests 3 and 4, which failed.
We also attempted with `AUTO_KV_JSON = false` and `KV_MODE = none` with the above tests 3 and 4, which failed
Note that the following works:
```
index=corelight sourcetype=corelight_notice signature="Scan::*"
| spath output=src path=src
```
When AUTO_KV_JSON=true, then most JSON fields are extracted (except for src).
When AUTO_KV_JSON=true and KV_MODE=json, then most JSON fields are extracted (except for src).
Any ideas on what the problem is?
```
{"_path":"notice","_system_name":"zEEK01","_write_ts":"2021-11-12T23:22:24.722517Z","ts":"2021-11-12T23:22:24.722517Z","note":"Scan::Address_Scan","msg":"kk: 192.168.0.1 scanned at least 27 unique hosts on ports 443/tcp, 80/tcp in 42m29s","sub":"local","src":"192.168.0.1","peer_descr":"proxy-01","actions":["Notice::ACTION_LOG"],"suppress_for":1,"severity.level":3,"severity.name":"error"}
```
Thanks,
Matt
