I am attempting to index and search JSON logs and each event contains an extra value ("none") for timestamp that I would like to eliminate.   Here is my inputs.conf [monitor:///home/username/json_test.log] index = index_name source = json_test.log sourcetype = json_kwarre_v3 host = myhostname Here is my  props.conf [json_kwarre_v3] BREAK_ONLY_BEFORE = ^{ MUST_BREAK_AFTER = }$ LINE_BREAKER = ^{ KV_MODE= json NO_BINARY_CHECK = true TIME_PREFIX = timestamp\"\:\ \" TIME_FORMAT=%Y-%m-%dT%H:%M:%S:%3N category = Structured description = A variant of the JSON source type, with support for nonexistent timestamps disabled = false pulldown_type = true BREAK_ONLY_BEFORE_DATE = Below, I have pasted the json event from the log.  The event actually looks like one line in the log, but when pasted into the ticket it appears as several lines. {"sessionId":"5b8d6d8d-8e63-413b-876e-34cfaa894676","service":"RAF","request":{"vendorId":"Digital","clientId":"2234567890g"},"response":{"vendorId":"Digital","clientId":"2234567890g","transactionStatus":"1000","transactionMessage":"Success"},"routing_time":"10","elapsedTime":"107","timestamp_begin":"2021-06-06T17:51:30.895Z","level":"info","message":"SUCCESS","timestamp":"2021-06-06T17:51:31.002Z"} I have attached screenshot of my results.  The only unexpected result I would like to eliminate is the extra "none" associated with the timestamp field   ... View more

I have the following log example and Splunk correctly pulls the first few fields (non-nested) as well as the first value pair of the nested fields.  However, after the first field, Splunk does not seem to recognize the remaining fields. { "sessionId": "kevin70", "service": "RAF", "request": { "vendorId": "Digital", "clientId: "1234567890d" }, "response": { "vendorId": "Digital", "clientId": "1234567890d", "transactionStatus": "7000", "transactionMessage": "Success" }, "elapsedTime": "513", "timestamp_begin": 2021-04-26T21:33:43.893Z, "level": "info", "message": "SUCCESS", "timestamp": "2021-04-26T21:33:44.406Z" } My props.conf looks like the following: [json_v3] BREAK_ONLY_BEFORE = ^{ LINE_BREAKER = ^{ KV_MODE=json NO_BINARY_CHECK = true TZ = America/Chicago category = Structured description = A variant of the JSON source type, with support for nonexistent timestamps disabled = false pulldown_type = true BREAK_ONLY_BEFORE_DATE = My inputs.conf looks like this: [monitor:///home/myuser/json_test.log] index = personalizedoffer source = json_test.log sourcetype = json_v3 host = myhost The last value pair that Splunk recognized is request.vendorId.  After that, no other fields are automatically generated.  Additionally, I have attempted to use spath by piping it to my simple search which is below: index=personalizedoffer source="json_test.log" I want the values of pairs represented including: request.clientId, response.vendorId, response.clientId, response.transactionStatus, response,transactionMessage, elapsedTime, timestamp_begin, level, message, timestamp Any help is appreciated!   ... View more