Deployment Architecture

Will INDEXED_EXTRACTIONS = JSON perform the extractions on an All-in-One platform?

actionabledata
Path Finder

All,

Will INDEXED_EXTRACTIONS = JSON perform the extractions on an All-in-One platform?

Here is my props.conf

The sourcetype was executed but none of the fields were extracted.

I can see the fields & values in _raw but they are not listed as fields.

Here is what I see with an adhoc search.
The time "field" within _raw is Jan 5, 2022
I did index the data on 2/22/22 but I am uncertain where the _time field came from. It matches nothing in the data. 
 
actionabledata_2-1645632966977.png

 

 props.conf (no transforms.conf)

# created on 2/22/2022 for a test case using INDEXED_EXTRACTIONS=JSON
# The non-highlighted settings are identical to a known working stanza for the exact same data

[allfields_index_extracted]
INDEXED_EXTRACTIONS = JSON
NO_BINARY_CHECK = true
LINE_BREAKER = ([\r\n]+)
EVENT_BREAKER = ([\r\n]+)
EVENT_BREAKER_ENABLE = true
SHOULD_LINEMERGE = false
TIME_PREFIX = ^"?{""?time""?:
TIME_FORMAT = %s.%6N
MAX_TIMESTAMP_LOOKAHEAD = 17
category = Structured
description = INDEXED_EXTRACTIONS eq JSON
pulldown_type = 1
# Search Time stuff
# Disable search time field extractions since INDEXED_EXTRACTIONS=JSON
KV_MODE = none
AUTO_KV_JSON = false

disabled = false

 Appreciate the help!

 

 

Labels (1)
0 Karma
1 Solution

actionabledata
Path Finder

Turns out that the app containing my master props.conf had been disabled within an app.conf file. Not sure  how, but it was.

Once enabled, the INDEXED_EXTRACTIONS - json worked well on our all in one development platform.

Special thanks to Woodock.

View solution in original post

Tags (1)

actionabledata
Path Finder

Turns out that the app containing my master props.conf had been disabled within an app.conf file. Not sure  how, but it was.

Once enabled, the INDEXED_EXTRACTIONS - json worked well on our all in one development platform.

Special thanks to Woodock.

Tags (1)
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...