Hi @akj  If your json well structured then event_breaking works fine hence you can see the fields extracted correctly on search UI. #props.conf should be deployed to UF along with additional setting you want. [sourcetype] INDEXED_EXTRACTIONS = json ---- in Search UI did you try spath? Works only if json is well structured. index=<idx> sourcetype=<your_st> | spath  --- An upvote would be appreciated if this reply helps! ... View more