I was running into this issue and thought I'd post a comprehensive solution in addition to somesoni2's nudge in the right direction. First thing, yes, I was using indexed extractions. The problem is that in etc/system/default/props.conf you find this:
AUTO_KV_JSON = true`
This means that by default Splunk is doing search-time extractions on all JSON. I added a stanza to etc/system/local/props.conf to turn that setting off for my data:
AUTO_KV_JSON = false
And that fixed the problem. Hopefully this helps other folks that come across this and saves them some time.
... View more