One comment for this workaround. It extracts those fields as expected, BUT if any event is shorter than 10241 (or whatever you have in limits.conf/kv stanza) character then you have duplicate fields on those events! Basically you can try to remove duplicates e.g.  | mvexpand <field name> | dedup <field name> Usually this must done one field only. Anyhow this is just workaround until you can fix those values in limits.conf (kv stanza). See e.g. https://community.splunk.com/t5/Splunk-Search/Why-are-not-all-field-values-are-extracted-for-long-JSON-files/m-p/573446  ... View more