You'd need to use btool to check at the OS level for any configs for that source and sourcetype, e.g.,  splunk btool props list RanorexJSon splunk btool props list source::ElectraExtendedUI (Make sure to get the sourcetype and source names accurate).  You're looking for parameters about indexed extractions.  Since a props can apply to both a sourcetype and a source (as well as host, but that's less likely), search for both. ... View more

This problem indicates you have indexed field extraction enabled on your JSON events and are at the same time doing search time extraction of the JSON. I typically recommend disabling indexed field extraction and do not rely on the built-in _json sourcetype, but instead use a more descriptive sourcetype that identifies the expected fields of the JSON, e.g. "myapp:json" which allows you to select it more readily for targeted additional processing or extraction. ... View more