Logs are showing raw, how do I get them to show as highlighted?

[bryhoffman]

When I click on the raw log and back out of it it shows up as highlighted. How do I default the sourcetype/source to always show as highlighted? I've messed with the props.conf and can't get it.

This only started occur after we migrated from On-Prem Splunk to Splunk Cloud. Before, these logs would automatically show up/parsed in JSON

[erikwie]

Are you sending the logs directly to Splunk Cloud or thru a Intermediate Forwarder?

An app with props.conf and transforms.conf uploaded to Splunk Cloud is run on the Search Head.
In my cases I had to install the app on the Intermediate Forwarder that sends on-prem logs to Splunk Cloud, when it worked as it had done before migrating to the cloud.

[isoutamo]

Have you migrated/moved those original props.conf from onprem to cloud? If you still have those somewhere just create an app from those and install it into cloud. Of course you must ensure that those have precedence over current configuration in cloud.

[bryhoffman]

Thanks for the response. Everything was migrated over and is exactly this same as before.

You would think there would be a toggle to always use highlighted syntax since it's already parsing JSON..

[richgalloway · Accepted solution]

If the data is same as before, but the presentation is different then there is something different in the settings now.

Use the btool command (part of the Admin's Little Helper app - a mandatory app for Splunk Cloud customers, IMO) to review the settings to make sure they are being applied as expected.