Assuming the event is true JSON, set the input sourcetype to either "json_no_timestamp" or "_json". These are built-in Splunk sourcetypes. As @kamlesh_vaghela said, the event you posted is not in true JSON format, but that might just be because you didn't copy the true raw value. Changing the input will only apply to future events. Once updated, if you go this route, trigger more events or wait, and all of your fields should be automatically extracted similar to the way you described. ... View more