I have tried the second method, but it does not work for me. I get an error message about that KV_MODE is an invalid keyword in transforms.conf and I get no extracted fields. As far as I can see from Splunk documentation, it is not supported to use "KV_MODE" in transforms.conf. ... View more

Sorry for being unclear, but I need the json extracted with paths to be able to distinguish between top level fields and fields within nested elements, with the same name. spath works excellent for searchtime, but I need it in props.conf/transforms.conf. ... View more

I have not found any examples of how to extract nested json automatically in prop.conf/transforms.conf. If you have such examples it would be much appreciated. ... View more