question : are you using an universal or lightweight forwarder, and are those props on he indexer or on the forwarder ? Because in general, the events are parsed by the indexers, so you may want to put those props on : - indexers - intermediary heavy forwarder (if any) ... View more

I'm borrowing regex from the CEF app here. You should be able to use this in the field extractor app or within your props & transforms. (?<=unkwnownProperties=)(.*?(?=(?:\s[\w.:\[\]]+=|$))) note that unkwnown is spelled wrong. It should be unknown but you provided incorrect spelling in your example. ... View more

Is this the actual json data? I tried linting it and it failed. http://jsonlint.com/ . Also, have you tried using KV_MODE=JSON in props.conf ? ... View more