If you use the "upload data" wizard, and select Structured>_Json you get the first example. The second example uses LINE_BREAKER and will break at the point designated... Splunk understands JSON and will extract the field for you. First one indexes the fields second one doesn't. [indexed_json] INDEXED_EXTRACTIONS = json KV_MODE = none NO_BINARY_CHECK = true category = Structured description = JavaScript Object Notation format. For more information, visit http://json.org/ disabled = false pulldown_type = true [JSON_LB] LINE_BREAKER = ([\r\n]+){"startDateInclusive": NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom pulldown_type = true ... View more